# Expert views: when attackers hijack AI models and agents

Experts and a new Symantec report point the same way: protect the AI itself, and keep the risk in proportion.

The Assurance Desk, news. Published 23 October 2026.

Symantec said on 21 October 2026 that attackers have built an agent that hijacks exposed AI models to run its own attacks. Alan Woodward, Merve Hickok, Jonathan Armstrong and Ciaran Martin have each posted views on attacks on AI ([security.com, Threat Intelligence](https://www.security.com/threat-intelligence), [security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), [Alan Woodward on LinkedIn](https://www.linkedin.com/posts/woodwardalan_threats-to-llms-not-from-llms-activity-7508485851593506817-siSf), [Merve Hickok on LinkedIn](https://www.linkedin.com/posts/mervehickok_national-institute-of-standards-and-technology-activity-7517565821615980544-fMPN), [Jonathan Armstrong on Bluesky](https://bsky.app/profile/armstrongjp.bsky.social/post/3mxvxylrcic2g) and [Ciaran Martin on Bluesky](https://bsky.app/profile/ciaranm.bsky.social/post/3mwdascqo422f), checked 23 October 2026).

## Alan Woodward: ask what can be done to AI

Woodward wrote that people spend a lot of time asking what AI might do to us. He added that they spend almost none asking what can be done to AI, and that anything we come to depend on becomes a target ([Alan Woodward on LinkedIn](https://www.linkedin.com/posts/woodwardalan_threats-to-llms-not-from-llms-activity-7508485851593506817-siSf), checked 23 October 2026).

Symantec's report describes one such attack. LLMjacking means an attacker steals access to someone else's AI model, and the victim pays for the computing power ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

> "We spend a lot of time asking what AI might do to us. We spend almost none asking what can be done to AI."
> Alan Woodward, LinkedIn post excerpt
> Alan Woodward on LinkedIn, AI Security Risks: Prompt Injection and LLM Trust, Alan W. posted on the topic, https://www.linkedin.com/posts/woodwardalan_threats-to-llms-not-from-llms-activity-7508485851593506817-siSf (checked 23 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/woodwardalan_threats-to-llms-not-from-llms-activity-7508485851593506817-siSf)

## Alan Woodward: a model cannot keep itself safe

In a second post, Woodward wrote that trained behaviour is a strong safeguard but not a full answer. It can be jailbroken from outside and switched off from inside ([Alan Woodward on LinkedIn](https://www.linkedin.com/posts/woodwardalan_when-constabulary-dutys-to-be-done-activity-7504845317138235392-2ZNr), checked 23 October 2026).

The attackers in Symantec's report tried exactly that. They used a jailbreak that told a commercial model to ignore its safety controls. The NCSC also says that safety controls built into a model may be bypassed ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet) and [NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 23 October 2026).

> "An AI cannot police itself. That duty remains ours."
> Alan Woodward, LinkedIn post excerpt
> Alan Woodward on LinkedIn, AI Safety Requires More Than Trained Models, Alan W. posted on the topic, https://www.linkedin.com/posts/woodwardalan_when-constabulary-dutys-to-be-done-activity-7504845317138235392-2ZNr (checked 23 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/woodwardalan_when-constabulary-dutys-to-be-done-activity-7504845317138235392-2ZNr)

## Merve Hickok: get the fundamentals right

Hickok was writing about NIST's new Key Practices for Incident Readiness and Response. She said organisations need the fundamentals right and zero-trust controls, with continuous monitoring and agent IDs on her list ([Merve Hickok on LinkedIn](https://www.linkedin.com/posts/mervehickok_national-institute-of-standards-and-technology-activity-7517565821615980544-fMPN), checked 23 October 2026).

The NCSC makes a similar point. It says every AI agent should have its own identity, separate from human users. It also says you should always be able to stop an agent at once if an incident is found ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 23 October 2026).

## Jonathan Armstrong and Ciaran Martin: keep it in proportion

Armstrong said some people concentrate on fanciful AI-assisted attacks while they ignore the attacks happening now ([Jonathan Armstrong on Bluesky](https://bsky.app/profile/armstrongjp.bsky.social/post/3mxvxylrcic2g), checked 23 October 2026).

Martin made a similar point about the FBI hack. He asked why so few people paid attention to it while they worried about an AI agent reading a website ([Ciaran Martin on Bluesky](https://bsky.app/profile/ciaranm.bsky.social/post/3mwdascqo422f), checked 23 October 2026).

Symantec's report fits that view. It says the techniques in the agent are not new. What stands out is that one agent now puts them together ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

> "I talked to ISMG about #AI assisted attacks & how some are concentrating on the fanciful while ignoring the attacks happening now"
> Jonathan Armstrong, Bluesky post excerpt
> Jonathan Armstrong on Bluesky, @armstrongjp.bsky.social on Bluesky, https://bsky.app/profile/armstrongjp.bsky.social/post/3mxvxylrcic2g (checked 23 October 2026)

## Questions to ask at work

Woodward asked where organisations draw the line on what an AI model is trusted to do. The questions below come from Symantec's and the NCSC's advice, and can help a team answer that ([Alan Woodward on LinkedIn](https://www.linkedin.com/posts/woodwardalan_threats-to-llms-not-from-llms-activity-7508485851593506817-siSf), checked 23 October 2026).

**Questions to ask at work, from Symantec's and the NCSC's advice**

| Theme | A question to ask | The advice behind it |
| --- | --- | --- |
| Exposure | Can anyone reach our AI models, gateways or MCP servers without logging in? | Symantec: do not expose them to the internet without authentication. |
| Keys | Who holds our AI API keys, and where are they kept? | Symantec: treat AI API keys as high-value credentials. |
| Approval | Which agent actions need a person to approve them? | Symantec: least privilege, and human approval for sensitive actions. |
| Identity | Does each AI agent have its own identity? | NCSC: give every agent its own unique identity. |
| Stopping | Can we stop an agent at once? | NCSC: always be able to pull the plug. |

Source: security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks, https://www.security.com/blog-post/ai-llmjacking-skynet (checked 23 October 2026); NCSC, Managing the cyber risk of agentic AI, https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai (checked 23 October 2026)

## Read next

- [Cyber security: the section](https://theassurancedesk.com/cyber-security)
- [AI agents: what to check before they act](https://theassurancedesk.com/guides/ai-agents-permissions-and-approvals)
- [What the NCSC's new AI research questions mean for you](https://theassurancedesk.com/guides/ncsc-ai-research-questions-what-they-mean)
- [What to ask an AI supplier before you buy](https://theassurancedesk.com/guides/what-to-ask-ai-supplier-before-you-buy)
- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident)

## Sources

- security.com, Threat Intelligence: https://www.security.com/threat-intelligence (checked 23 October 2026)
- security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks: https://www.security.com/blog-post/ai-llmjacking-skynet (checked 23 October 2026)
- Alan Woodward on LinkedIn: https://www.linkedin.com/posts/woodwardalan_threats-to-llms-not-from-llms-activity-7508485851593506817-siSf (checked 23 October 2026)
- Merve Hickok on LinkedIn: https://www.linkedin.com/posts/mervehickok_national-institute-of-standards-and-technology-activity-7517565821615980544-fMPN (checked 23 October 2026)
- Jonathan Armstrong on Bluesky: https://bsky.app/profile/armstrongjp.bsky.social/post/3mxvxylrcic2g (checked 23 October 2026)
- Ciaran Martin on Bluesky: https://bsky.app/profile/ciaranm.bsky.social/post/3mwdascqo422f (checked 23 October 2026)
- Alan Woodward on LinkedIn: https://www.linkedin.com/posts/woodwardalan_when-constabulary-dutys-to-be-done-activity-7504845317138235392-2ZNr (checked 23 October 2026)
- NCSC, Managing the cyber risk of agentic AI: https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai (checked 23 October 2026)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.