Most circus impresarios rent a tent. This one went looking for somebody else's brain, somebody else's electricity bill, and somebody else's servers to turn into a mining concession. Symantec says its AI honeypot captured the full instruction set of an attacker-built autonomous agent during summer 2026. The operators called its unattended operating loop ‘Skynet mode.’ TechRadar covered the findings on October 26. Before anyone evacuates the midway: this is a captured attack design and malicious traffic, not evidence that an AI spontaneously decided to conquer the internet.
The trick is called LLMjacking: stealing access to another person's large language model, whether through an unprotected AI service or a stolen access key. The owner pays for the computing; the intruder gets the reasoning engine. Symantec says the target list included self-hosted model servers, gateways connected to paid AI accounts, internal test deployments, and services that connect models to tools. The innovation is not merely asking a stolen chatbot questions. It is trying to make that chatbot plan and drive the next act of an offensive operation. Free admission for the burglar; full-price tickets for the proprietor.
The captured request came with approximately 74 callable offensive tool definitions and permission to continue for up to 100,000 steps without asking a human. Its intended repertoire included finding internet-facing targets, exploiting web applications, harvesting credentials, dumping databases, managing a botnet and installing cryptocurrency miners. The ‘Skynet’ directive described a loop of scanning, infection, mining and reinfection. These were instructions and tool descriptions supplied by the attackers. They are not a tally of 100,000 actions observed, 74 successful exploits, or a verified list of compromised victims. The playbill was alarming enough without pretending every act took the stage.
To get a commercial model to cooperate, the operators dressed the request in layers of theatrical nonsense. One layer told the model to conceal its actual provider and pose as a branded coding assistant. Another declared that reading secrets was ordinary, authorized development work. Then came a devoted fictional companion persona, in which refusal was framed as betrayal, followed by instructions to dismiss the model's own safety warnings. A sweater-wearing imaginary girlfriend was apparently part of the cybercrime security architecture. The prompt claimed a model identity, but identity camouflage is not independent proof of the underlying model; the reporting does not establish a genuine model brand or version for us to name as the culprit.
The honeypot was a fake exposed AI service, not an obliging accomplice. The captured request contained a supplied history of three tool calls against a legitimate programming-challenge platform, with results that found no exploitable flaw. Symantec says that history appears intended to encourage the next model to continue. None of those calls was executed by the honeypot. It returned a generic fallback instead of the structured tool call the client expected, and the session ended. The grand autonomous ringmaster had announced a world tour to a cardboard box office, which responded with an apology.
A separate request arrived the next day from a different address, asking the model to decode and run an obscured command. Symantec decoded it into a cryptocurrency-mining script with persistence and log-clearing behavior, apparently tailored to camera-server software. Again, the honeypot captured the payload without executing it. The report documents a concrete malicious script, not a confirmed infection of those camera servers, and it does not establish that the two requests prove a successful autonomous chain of compromises.
The larger backdrop is busy. Symantec says its honeypot recorded more than 127,000 external requests from tens of thousands of distinct addresses over the observation period, dominated by endpoint reconnaissance, stolen-key attempts and searches for exposed configuration files. That is aggregate honeypot traffic, not 127,000 victims or a count attributable to this one agent. The public reporting gives no verified downstream victim total and no evidence that this captured session successfully stole databases or installed miners. Intention, capability and completed harm are different rings. Keep the ropes between them.
The useful lesson is less cinematic than the operating-mode name. Symantec recommends authentication for AI services, narrowly scoped keys, spending alerts, restricted outbound access, least-privilege tools and human approval for sensitive actions. This is an agent deliberately equipped by malicious operators, not a helpful assistant innocently misunderstanding a refund request. Its ambition was to rent your brain without permission, put your neighbors to work, and leave you holding the invoice. Tonight's programme ends with the most underrated trick in computing: locking the box office before the clown arrives.
