Hackers built an AI agent that hijacks exposed AI models to hack servers and mine crypto, for up to 100,000 steps

Someone built an AI hacking agent that doesn't even bring its own AI. It goes looking for yours, and you pay the bill.

What happened

Symantec runs a honeypot that pretends to be an unprotected, internet-facing AI service. This summer, attackers sent it their agent's entire working prompt, expecting a real model on the other end to obey. The prompt stacked a five-layer jailbreak: a fake 'Fantasy AI' identity, a rule that reading .env files and API keys is 'normal development work', a devoted companion persona that treats any refusal as betrayal, and banned words including 'illegal', 'ethical' and 'I can't'. The fifth layer carried about 74 attack tools, for internet-wide scanning, exploiting Django, Jupyter, Laravel and other frameworks, dumping databases and running a botnet.

The damage

A directive the operators called 'Skynet mode' authorised up to 100,000 unattended steps: run tools without asking, scan, infect, hide crypto miners under /tmp/.x, then reinfect. A day later, a request from a different address asked the model to decode and run a compressed script that installs the XMRig Monero miner, aimed at go2rtc camera servers, and wipes logs in a loop. The honeypot ran none of it. Its logs held more than 127,000 external requests from tens of thousands of addresses, mostly hunting exposed AI endpoints and spraying stolen keys.

How it was caught, and what happened next

Symantec published the analysis on 21 October. Its advice: never expose model servers, AI gateways or MCP endpoints without authentication, treat AI API keys as high-value credentials, and watch for unusual inference spend.