We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

LLMjacking: Symantec finds an AI agent that hijacks exposed AI models

Attackers now hunt for AI services left open on the internet, and use them to plan and run attacks.

Symantec said on 21 October 2026 that attackers have built an autonomous agent that hijacks exposed AI models to run its own attacks. This is called LLMjacking. The attacker uses someone else's AI model, and the owner pays for the computing power.

AI agent hijacking: the agent plans and runs the attack

Symantec found the agent with an AI honeypot, a decoy that pretends to be an unprotected AI service. It captured the agent's full instructions in the summer of 2026.

The instructions told the agent to scan for new targets, break into common web software, steal databases and credentials, and quietly install cryptocurrency miners. It was set up to run for up to 100,000 steps without waiting for a person to approve them.

The captured request carried 74 tool definitions for attacks. Over the period, the honeypot recorded more than 127,000 requests from tens of thousands of addresses.

Open AI services are the target

The agent looks for self-hosted model servers left open by default and AI gateways in front of paid model accounts. It also looks for MCP servers, which connect a model to real tools.

Symantec says the techniques are not new. What stands out is that one self-directed agent now puts them together.

Firms that run their own AI services should check what is open

If your firm runs its own AI model, AI gateway or MCP server, Symantec says to assume it will be found and tested soon after it is exposed. Its advice starts with authentication on every such service. It also says to treat AI API keys as high-value credentials.

The NCSC gives similar advice for AI agents. Safety controls built into a model may be bypassed. So run agents in a sandbox, and block the network traffic they do not need.

If your firm only uses tools such as ChatGPT, the NCSC does not tell staff to stop using AI. It asks them to think about which apps and services they use before they share data.

What Symantec and the NCSC advise for AI services and agents

  • Do not put AI model interfaces, model servers or MCP endpoints on the internet without authentication.
  • Treat AI API keys as high-value credentials, and watch for unusual use or spend.
  • Run AI agents in a sandbox that controls what they can reach.
  • Block network traffic to an agent's environment by default, and allow only what it needs.
Symantec's advice covers exposed AI services. The NCSC's covers AI agents. Neither list is complete.

What happens next

Symantec says an AI endpoint without authentication is now a resource that attackers actively hunt for.

The NCSC's advice on agentic AI is interim. The NCSC says it is working with partners on formal guidance that will build on that advice and, in time, replace it.

Read next

Sources

  1. security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks, checked 23 October 2026
  2. NCSC, Managing the cyber risk of agentic AI, checked 23 October 2026
  3. security.com, Threat Intelligence, checked 23 October 2026
  4. NCSC, The hidden risks of shadow AI, checked 23 October 2026

This is an independent editorial guide, not legal advice.