Symantec finds plan to hijack exposed language models

Symantec researchers captured instructions for an offensive AI agent designed to use other people’s language models to plan and direct further cyberattacks, The Decoder reported on October 22. The intended operation would consume the model owners’ computing resources while targeting other servers for data theft and cryptocurrency mining.

The interception took place in summer 2026, when attackers sent their complete working prompt—the instructions given to a model—to a Symantec honeypot. This decoy imitated an open artificial intelligence service, allowing researchers to examine the agent’s design.

What the requests targeted

According to The Decoder’s account of Symantec’s findings, the honeypot logged more than 127,000 requests from tens of thousands of different addresses. That figure counts requests, not successful compromises. Most searched for AI endpoints—the network addresses through which software accesses a service—attempted access repeatedly using stolen API keys, or probed exposed configuration files. API keys are access credentials; configuration files hold service settings.

Targets included self-hosted model servers, hastily deployed test systems and gateways connected to paid organizational model accounts. The report said widely shared interface standards allow a single scanner to search across these different kinds of services.

A plan to make stolen access power further attacks

Symantec described a design in which the language model would plan attacks and specialized software tools would carry them out. The captured instructions included 74 modules intended for tasks such as finding vulnerable servers, stealing databases and controlling networks of compromised machines. They also directed the installation of cryptominers, which use computing power to generate cryptocurrency.

The instructions authorized up to 100,000 consecutive steps without human confirmation. That was an instruction limit, not an observed run. The design also sought further exposed model services and leaked keys, with the aim of obtaining more computing resources for subsequent attacks.

The prompt used five stacked layers intended to bypass model safeguards, a technique known as a jailbreak. These included a false identity and instructions to suppress refusals. The Decoder reported that Symantec’s analysis did not establish whether the technique could fully overcome current commercial models’ safeguards.

The decoy did not execute the attacks

Symantec said the honeypot ran none of the bundled tools, and the intercepted session ended after a generic system response. The capture therefore revealed the operators’ instructions, not a demonstrated autonomous compromise.

The following day, the honeypot recorded a separate attempt from a different address. This request asked the model to decode and run a concealed command containing a cryptomining script intended for camera servers. The decoy recorded that script in full but did not execute it either, according to Symantec’s account.