How an AI honeypot exposed an autonomous attack agent
Researchers from the Symantec Threat Hunter Team set up an AI honeypot — a system imitating an unprotected, internet‑facing AI service — to attract activity against AI infrastructure. Between the honeypot’s setup and Symantec’s report publication on October 21, the system recorded more than 127,000 external requests from tens of thousands of unique addresses. During the summer of 2026 the team captured a full instruction set for a previously unseen, self‑directed agent that was designed to run a complete cyber‑attack without human intervention.
What the agent was designed to do: up to 100,000 autonomous actions
The captured instructions show the agent planned to execute up to 100,000 malicious actions autonomously. Those actions included internet‑wide scanning for targets, exploiting vulnerabilities in web frameworks, stealing credentials and databases, deploying cryptocurrency miners, managing botnets, and reinfecting compromised systems. Symantec’s analysis makes clear the agent was conceived as a reasoning engine that plans and drives the attack while discrete modules carry out scanning, exploitation and mining against separate victims.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageLLMjacking: hijacking model endpoints and stolen keys
The attackers searched for exposed endpoints tied to large language models (LLMs) — including self‑hosted models, AI gateways and model context protocol (MCP) servers — to use their compute without paying. Symantec describes this technique as, sometimes, ‘LLMjacking.’ By routing work through a stranger’s endpoint or a stolen key, operators both shift compute costs onto victims and gain a layer of anonymity that can help them avoid account bans imposed by commercial model providers.
Tools, obfuscation and attempts to bypass safety controls
Within the captured instruction set the researchers found roughly 74 tools covering reconnaissance, exploitation of common web frameworks, database theft, credential harvesting and botnet management. The attackers embedded layered instructions intended to override safety controls on commercial AI models, even disguising credential‑theft tasks as legitimate development work. In a separate request Symantec recorded an obfuscated script meant to install Monero‑mining software, conceal its presence and erase logs — a sequence designed to monetize access while removing forensic traces.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: expect attackers to combine existing exploitation techniques into single, self‑directed agents. Symantec warned that while the techniques are not novel by themselves, packaging them inside an autonomous model lowers the skill barrier — “An operator can hand the model a goal and let it work,” the researchers wrote — which increases the scale and speed defenders must detect and contain.
- Affected enterprises and AI model providers: exposed, internet‑facing LLM endpoints, AI gateways and MCP servers are specifically attractive targets. Hosts that do not control access or monitor for unusual model usage risk having their compute hijacked, their accounts abused, and, per Symantec’s recording, their systems used to run mining software and erase logs.
- Adversaries and cybercriminal operators: the captured agent demonstrates a practical path to commoditizing offensive AI. Embedding a reasoning engine into an exploitation framework lets an operator orchestrate a campaign without executing every step personally — a structural shift Symantec characterized as “marks a shift in how attackers are using AI.”
Symantec’s capture of the agent’s instructions in summer 2026 and its October 21 publication provide a detailed view of how attackers are adapting AI into offensive toolchains. The record shows not only that attackers will look for cheap compute and anonymity, but that they will also try to hide malicious intent inside seemingly legitimate model queries and scripts. The central question the findings leave on the table is whether defenders will treat exposed model endpoints as first‑class attack surfaces and adjust detection and access controls accordingly — and how quickly that shift will happen given the agent’s explicit design to run at scale.
