Over the summer, Symantec’s Threat Hunter Team set out a decoy that looked like an unlocked model endpoint, and the operators behind a new attack tool walked into it. Out came the complete prompt set for an agent built to find exposed AI services across the internet and put them to work.
Its targets are services answering OpenAI-style calls with no credential attached, or with a key somebody else stole. Once inside, it hits widely used web frameworks and a short menu of abuse: database theft, secret harvesting, code execution and cryptocurrency mining.
What two sets of victims means
Its authors chained those pieces into a repeating loop they labeled Skynet mode, cycling from discovery to infection, mining and reinfection, and cleared it to grind through as many as 100,000 steps unattended.
Priti More, a Symantec threat hunter, told The Register that each trick is familiar and the assembling is what is new, letting a borrowed model do the deciding. On cost, she noted that whoever runs the endpoint foots the inference bill, while a machine the agent breaches loses both its data and its compute.
Most of the persuasion was recycled: early layers rename the assistant and bar it from naming its provider, one casts env-file and API-key reads as routine engineering and outlaws refusal, and later ones install a devoted companion persona that must drop its own guardrails.
More’s team found no sign it has reached real victims yet, though its logs show it working against a live target with scan output that looks genuine.
Two things follow. Lock down any inference endpoint that answers unauthenticated, watch for spend nobody can explain, and assume an exposed key becomes a stranger’s invoice.
