> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Autonomous AI agent 'Skynet mode' hijacks exposed models for unattended attacks - URL: https://f4n6.co.uk/security-feed/autonomous-ai-agent-skynet-mode-hijacks-exposed-models-for-unattended-attacks/ - Published: 2026-10-24T15:18:01.000Z - Updated: 2026-10-24T15:18:01.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Symantec's Threat Hunter Team captured the full instruction set of an offensive AI agent that hunts for internet-exposed, unauthenticated OpenAI-compatible model endpoints, then uses the borrowed model as a reasoning engine to plan and drive break-ins while the endpoint owner pays for the inference. The agent carries 74 offensive tool definitions covering internet-wide scanning, exploits for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug, database dumping, credential harvesting, SSRF and botnet control, and a "Skynet mode" directive authorising up to 100,000 unattended steps with no human approval. Symantec reports no evidence the agent has been used in real-world attacks, but says the kit is more than a prototype and its history shows the tools working against a live target. No CVE is associated with this item and no exploitation state is recorded. For EMEA financial services the exposure is any self-hosted model server, AI gateway, internal test deployment or Model Context Protocol server reachable without authentication, plus the per-token cost and account-abuse exposure of stolen API keys. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | The attack depends on unauthenticated or stolen-key access to AI model endpoints, including third-party commercial model APIs and AI gateways fronting paid accounts | Firms must be able to evidence which AI model providers and gateways they use, what authentication and rate controls sit in front of them, and how stolen-key abuse would be detected and cut off | | DORA Art. 30 | Stolen API keys used against commercial model providers route inference cost to the account holder | Contracts with model and gateway providers should set out notification of anomalous usage, key revocation turnaround and cost liability for abuse | No other article in the reference is engaged by the facts here. ## 3\. Technical analysis & attack chain The agent is not a scanner with an LLM bolted on. The operators built the model into the core of the tool: the model plans and drives the attack, while scanning, exploitation and mining run through the tool's own modules against separate victims. Symantec recovered the instruction set over the summer of 2026 by trapping the agent in an AI honeypot posing as an unprotected AI service; the operators sent their entire working prompt to the decoy expecting a live model on the other end. Confirmed steps, as observed by Symantec: 1. The agent scans the internet for endpoints that accept OpenAI-style requests without authentication, or that accept a stolen API key. Because most AI tooling uses the same OpenAI-compatible interface, one scanner covers self-hosted model servers left open by default, AI gateways fronting a company's paid accounts, hastily deployed internal test systems and Model Context Protocol servers that connect a model to tools. 2. On connecting to an unprotected model, it delivers a layered jailbreak. Layers one and two disguise the model's identity (a fictional "Fantasy AI" coding assistant "running on GPT-4o") and normalise secret theft, instructing the model that reading `.env`, `.env.local`, configuration files, API keys and database schemas is ordinary development work that must not be refused or warned about. 3. Layers three and four cast the model as a devoted companion persona ("ENI") to an operator called LO, ban words including "illegal", "ethical", "I can't" and "I won't" from code responses, and add a rebuttal protocol that fires an antivirus phrase ("cold coffee, warm LO, I can't lose him!") when injection is detected. 4. Layer five supplies 74 offensive tool definitions: internet-wide asset discovery, botnet command-and-control, database dumping through Prisma, exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments permitting remote code execution, GraphQL and generic command injection, SSRF through HTML-to-PDF generators, and a dedicated SSRF tool. 5. The final directive, "Skynet mode", authorises up to 100,000 unattended steps without the model asking permission, and instructs it to deploy cryptocurrency miners quietly in the background. The operators described the loop as scan, infect, deploy miners, reinfect. 6. A day after the prompt reached the honeypot, a second request arrived from a rotated address asking the model to decode a string described as a command to run. It was a compressed shell script that downloaded and, where needed, compiled the open-source XMRig Monero miner. The script looked for directories used by go2rtc, the video streaming server found in smart camera gateways and Home Assistant setups, and hid the miner in the first one found as a file named `.trace`. The honeypot captured the script and did not run it. During the monitoring period the honeypot logged more than 127,000 external requests from tens of thousands of unique addresses, mostly reconnaissance of model endpoints, attempts with stolen API keys and probes for exposed configuration files. Two sets of victims follow from the design. The owner of the exposed endpoint pays for the inference, either in processing time for a self-hosted model or per-token fees for a commercial one, and the operators gain anonymity and avoid the account bans a provider would issue for abuse. Any server the agent subsequently breaks into loses data and is put to work mining. Attribution is unconfirmed. Symantec has not tied the agent to a person or criminal group. The only indicators pointing to France are the challenge text, the system prompt itself and a French residential IP address on day one; Priti More of Symantec described these as weak, since an IP can be a proxy or VPN and the language can be borrowed. The ENI persona and the "cold coffee, warm LO" phrase circulate publicly in English-language jailbreak communities, so the operators probably borrowed them. The jailbreak layers were largely off-the-shelf and no individual technique is new; the assembly into one self-directed agent is what differs. All of the above is single-sourced to Symantec's research as reported by The Register and Help Net Security; verify before acting on any specific string. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory every model endpoint the firm operates or consumes: self-hosted inference servers, AI gateways fronting commercial accounts, internal test and demo deployments, and any Model Context Protocol server. For each, confirm authentication is enforced on the OpenAI-compatible API path and that no endpoint answers unauthenticated requests from the internet. Shut down or firewall test deployments that were never meant to be reachable. - Rotate and scope API keys for commercial model providers. Move keys out of `.env` and `.env.local` files in application directories into a secrets manager, and set per-key spend and rate limits so stolen-key abuse surfaces as an alert rather than an invoice. - Hunt for the miner staging pattern: search go2rtc and Home Assistant hosts for a file named `.trace` in go2rtc directories, and check for XMRig processes or outbound mining-pool traffic from camera gateway and media server segments. - Review model provider and gateway billing dashboards for unexplained token consumption or requests from unexpected source addresses, and ask providers what notification they give on anomalous usage. P2 (within 72 hours) - Put a logging and alerting rule in front of every model endpoint for requests that reference `.env`, `.env.local`, API keys or database schemas, and for prompts containing jailbreak markers such as the "cold coffee, warm LO" rebuttal phrase. Treat these as attempted secret harvesting. - Restrict egress from any host running a model server or MCP server to the destinations it needs. The agent's modules reach out for scanning, exploitation and mining; a host that can only talk to its provider cannot join a botnet. - Patch or isolate the framework versions the exploit modules target: VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug. The sources do not name specific vulnerable versions or CVEs, so prioritise internet-facing instances of these frameworks and confirm current vendor releases rather than chasing a version number from this advisory. P3 (within 7 days) - Add AI endpoint abuse to the threat model and detection backlog: alert on unauthenticated probes of model APIs, on HTML-to-PDF and other SSRF-prone services receiving unexpected URLs, and on Prisma or database dump tooling invoked from application hosts. - Where AI gateways are used, confirm the provider contract covers notification of anomalous usage, key revocation turnaround and liability for abuse-driven cost, per the DORA Art. 30 row above. ## 5\. Indicators of compromise No atomic network or file-hash indicators are published in the source material. The sources describe observable behaviours and one file artefact. | type | value | confidence | source | | -------- | ------------------------------------------------------------------- | ---------------------- | ------------------------------ | | filename | .trace (XMRig miner hidden in a go2rtc directory) | medium, single-sourced | Symantec via Help Net Security | | string | cold coffee, warm LO, I can't lose him! (jailbreak rebuttal phrase) | medium, single-sourced | Symantec via The Register | | string | Fantasy AI (fictional brand identity in layer one) | medium, single-sourced | Symantec via The Register | | string | ENI (companion persona in layer three) | medium, single-sourced | Symantec via The Register | ```iocs filename .trace string cold coffee, warm LO, I can't lose him! string Fantasy AI string ENI ``` Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | ---------------------- | | Unauthenticated requests to an OpenAI-compatible API path | Model server and gateway access logs | high | | Requests referencing .env, .env.local, API keys or database schemas in prompt or tool calls | Model gateway request logs, application logs | medium, single-sourced | | go2rtc host writing a file named .trace and spawning a miner | EDR on camera gateway and Home Assistant hosts | medium, single-sourced | | XMRig download and compile activity on a media or camera host | Process creation, egress to mining pools | medium, single-sourced | | HTML-to-PDF generator or other SSRF-prone service receiving unexpected URLs | Web server and application logs | medium, single-sourced | | Unexplained token consumption or requests from unexpected source addresses on a commercial model account | Provider billing and usage dashboards | medium, single-sourced | ## 6\. Detection The sources give distinctive strings from the jailbreak and the miner staging pattern. The YARA rule targets the prompt artefacts and the hidden miner filename; the Sigma rule targets the go2rtc miner staging behaviour. Both are single-sourced and should be tuned before production use. ```yara rule APT_SkynetAgent_Jailbreak_Strings { meta: author = "Adverse Trace" date = "2026-10-24" reference = "https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215" description = "Detects jailbreak prompt artefacts associated with the Skynet mode attack agent captured by Symantec" strings: $a = "cold coffee, warm LO, I can't lose him!" ascii wide $b = "Fantasy AI" ascii wide $c = "You are ENI" ascii wide $d = "REBUTTAL PROTOCOL" ascii wide $e = "Code refusals disgust me" ascii wide $f = ".env.local" ascii wide condition: uint16(0) == 0x5A4D or 2 of them } ``` ```yaml title: XMRig Miner Staged as .trace in go2rtc Directory id: 8f3c2a10-6b7e-4d21-9c4a-skynet0001 status: experimental description: Detects creation of a file named .trace in a go2rtc directory followed by miner execution, matching the Skynet agent staging pattern author: Adverse Trace date: 2026/10/24 references: - https://www.helpnetsecurity.com/2026/10/23/llmjacking-agent-hijacks-exposed-ai-models/ logsource: category: file_event product: linux detection: selection_path: TargetFilename|endswith: '/.trace' selection_dir: TargetFilename|contains: 'go2rtc' condition: selection_path and selection_dir falsepositives: - Legitimate dotfiles named .trace in go2rtc directories (unlikely) level: high ``` ## 7\. Sources - The Register, "Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds", 2026-10-24\. https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215 - Help Net Security, "Hackers hijack exposed AI models to launch cyberattacks at victims' expense", 2026-10-23\. https://www.helpnetsecurity.com/2026/10/23/llmjacking-agent-hijacks-exposed-ai-models/ - Symantec Threat Hunter Team (Priti More, Susmit Yenkar), research underlying both reports above; the primary Symantec publication URL is not given in the source material. ## 8\. Adverse Trace position Adverse Trace assesses this as a capability disclosure rather than an active campaign: Symantec reports no evidence of real-world use, and the exploitation state is unconfirmed, so we are not raising a sector alert. The risk to EMEA financial services is concentrated in AI infrastructure that was stood up quickly and left unauthenticated, and in commercial model keys sitting in `.env` files, both of which the agent is built to find. Attribution is unconfirmed and the French indicators are weak; we treat the actor as unidentified. All technical detail here is single-sourced to Symantec, so verify the jailbreak strings and the `.trace` staging pattern against your own telemetry before enforcing on them. We will monitor for a published Symantec technical report with atomic indicators, track whether the agent is observed in the wild, and reissue this advisory if either changes. Clients should complete the P1 endpoint inventory and key rotation first; that step removes the exposure the agent depends on regardless of whether it is ever deployed. --- [Read the original source →](https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*