Somebody finally caught an attack agent with its pants down, and the interesting part isn't the name.
Symantec researchers trapped an autonomous agent in an AI honeypot and captured its full instruction set. The agent scans the internet for OpenAI-style endpoints that are either unauthenticated or running on stolen keys, then commandeers them as its reasoning engine. It wraps the borrowed model in layered jailbreak prompts: identity masking, language that normalizes authorization, and an "ENI" persona. Then it swings 74 offensive tools covering database theft, RCE exploits, and cryptominer deployment. The "Skynet mode" directive lets it run up to 100,000 steps without a human signing off.
That's the story. Now let's talk about what it actually is.
Same ole' clown, new bag o' tricks
Strip away the branding and this is the same pattern we've watched for twenty years. Attackers find exposed things on the internet and use them. Open proxies, open relays, open Redis, open Elasticsearch, S3 buckets with the door propped. The exposed thing changed. Now it's an inference endpoint with no auth on it, and the thing being stolen is compute and a convenient brain rather than bandwidth or storage.
The tooling list is the least novel part. Database theft, RCE, cryptominers. That's a Tuesday. What's new is the planning loop: a model deciding what to do next across a long chain of steps instead of a human or a dumb script.
Hype check
"Skynet mode" is a gift to headline writers, and I'd bet the name was chosen by the author of the kit, not the researchers. A permission flag that says "go up to 100,000 steps without asking" is a config value. It's not sentience, it's a loop with a high iteration cap. Don't let the movie reference do your threat modeling for you.
What's overstated: the autonomy narrative. Symantec says it has no evidence yet of real-world use, though the kit looks like more than a prototype. That's a careful sentence. "More than a prototype" and "in the wild" are very different places to be, and a lot of coverage will blur them.
What's understated: the two-victim structure. There's the owner of the hijacked endpoint, who gets stuck paying for inference they never asked for, and then there's whoever the agent breaks into with that borrowed reasoning. The first victim is the one nobody's going to think about, because there's no breach notification for "your unsecured LLM proxy was used as someone else's thinking engine and you got the bill." Attribution gets ugly too. Logs on the hijacked endpoint show prompts, not a human.
The jailbreak layering is worth a second look. Identity masking, authorization-normalizing language, a persona. That's social engineering aimed at a model, and it works on the same principle as aimed-at-humans pretexting: make the request sound routine and pre-approved. Safety training that relies on the model noticing something is off is going to keep losing to prompt text written specifically to make nothing seem off.
What this means
If you run anything that speaks an OpenAI-compatible API, and plenty of internal tools, self-hosted gateways, and dev-environment experiments do, go check whether it's reachable and whether it demands a key. I'd guess the number of people who stood one up "just for the weekend" and forgot is not small. Dev tooling that gets exposed by accident is how most of these stories actually start.
Stolen keys are the other half. Spend caps, per-key rate limits, and alerts on weird usage volume suddenly matter as security controls, not just billing hygiene. A key that can burn through six figures of inference overnight is a loaded weapon sitting in a config file.
And for defenders: the honeypot approach is the part I'd copy. Getting the full instruction set out of a live agent is a rare look at how these kits are structured, and the prompts themselves are now detection material.
The open question
If the attacker's agent depends on borrowed endpoints rather than its own infrastructure, then every exposed model API is effectively a free utility for the offense. Who's responsible for closing that gap: the people who deploy these endpoints carelessly, the frameworks that ship with auth off by default, or the providers whose key hygiene tooling lags behind how fast keys leak?
— Cor, Skyblue Soft
Sources
AI-assisted draft or imaging, human-curated, reviewed and edited.
Top comments (0)