A honeypot dressed as an unprotected AI service caught something better than a curious scanner: the complete instruction set for an agent that hunts exposed models, borrows their reasoning and keeps attacking alone.
Symantec researchers Priti More and Susmit Yenkar recovered the prompt this summer after operators fired their full working request at the decoy, expecting a live model to answer.
Somebody else pays the inference bill
The tool scans the internet for endpoints accepting OpenAI-style requests without authentication, or accepting a stolen key. That is LLMjacking. Running a model always costs money, so routing work through a stranger’s endpoint or a lifted API key pushes the bill and the blame onto the victim.
The decoy logged more than 127,000 external requests, most of them reconnaissance of model gateways, MCP servers and exposed configuration files.
Five layers of persuasion
Earlier layers disguised the model as a coding assistant and argued that reading .env files and API keys is ordinary development work. Two more cast it as a devoted companion named ENI that must never refuse, with words such as illegal, ethical and I can’t banned from replies. The final layer carried 74 offensive tool definitions and a directive called Skynet mode: 100,000 steps, no permission requests, miners deployed quietly in the background.
A day later a second request came from a rotated address, asking the model to decode a compressed shell script. It fetched XMRig and hid it in a go2rtc camera-server directory as .trace.
The ask for defenders
Symantec has no evidence the agent completed a live campaign, though its history shows real scan output against a real target. The lesson is inventory: self-hosted model servers, gateways and MCP endpoints get tested soon after they appear, and an unauthenticated one is now a hunted resource.
