# LLMjacking: Symantec finds an AI agent that hijacks exposed AI models

Attackers now hunt for AI services left open on the internet, and use them to plan and run attacks.

The Assurance Desk, news. Published 23 October 2026.

Symantec said on 21 October 2026 that attackers have built an autonomous agent that hijacks exposed AI models to run its own attacks. This is called LLMjacking. The attacker uses someone else's AI model, and the owner pays for the computing power ([security.com, Threat Intelligence](https://www.security.com/threat-intelligence) and [security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

## AI agent hijacking: the agent plans and runs the attack

Symantec found the agent with an AI honeypot, a decoy that pretends to be an unprotected AI service. It captured the agent's full instructions in the summer of 2026 ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

The instructions told the agent to scan for new targets, break into common web software, steal databases and credentials, and quietly install cryptocurrency miners. It was set up to run for up to 100,000 steps without waiting for a person to approve them ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

The captured request carried 74 tool definitions for attacks. Over the period, the honeypot recorded more than 127,000 requests from tens of thousands of addresses ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

## Open AI services are the target

The agent looks for self-hosted model servers left open by default and AI gateways in front of paid model accounts. It also looks for MCP servers, which connect a model to real tools ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

Symantec says the techniques are not new. What stands out is that one self-directed agent now puts them together ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

## Firms that run their own AI services should check what is open

If your firm runs its own AI model, AI gateway or MCP server, Symantec says to assume it will be found and tested soon after it is exposed. Its advice starts with authentication on every such service. It also says to treat AI API keys as high-value credentials ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

The NCSC gives similar advice for AI agents. Safety controls built into a model may be bypassed. So run agents in a sandbox, and block the network traffic they do not need ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 23 October 2026).

If your firm only uses tools such as ChatGPT, the NCSC does not tell staff to stop using AI. It asks them to think about which apps and services they use before they share data ([NCSC, The hidden risks of shadow AI](https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai), checked 23 October 2026).

**What Symantec and the NCSC advise for AI services and agents**

- Do not put AI model interfaces, model servers or MCP endpoints on the internet without authentication.
- Treat AI API keys as high-value credentials, and watch for unusual use or spend.
- Run AI agents in a sandbox that controls what they can reach.
- Block network traffic to an agent's environment by default, and allow only what it needs.

Symantec's advice covers exposed AI services. The NCSC's covers AI agents. Neither list is complete.

Source: security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks, https://www.security.com/blog-post/ai-llmjacking-skynet (checked 23 October 2026); NCSC, Managing the cyber risk of agentic AI, https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai (checked 23 October 2026)

## What happens next

Symantec says an AI endpoint without authentication is now a resource that attackers actively hunt for ([security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks](https://www.security.com/blog-post/ai-llmjacking-skynet), checked 23 October 2026).

The NCSC's advice on agentic AI is interim. The NCSC says it is working with partners on formal guidance that will build on that advice and, in time, replace it ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 23 October 2026).

## Read next

- [Cyber security: the section](https://theassurancedesk.com/cyber-security)
- [AI agents: what to check before they act](https://theassurancedesk.com/guides/ai-agents-permissions-and-approvals)
- [What the NCSC's new AI research questions mean for you](https://theassurancedesk.com/guides/ncsc-ai-research-questions-what-they-mean)
- [Can staff paste client data into ChatGPT or Copilot?](https://theassurancedesk.com/guides/staff-client-data-chatgpt-copilot)
- [What to ask an AI supplier before you buy](https://theassurancedesk.com/guides/what-to-ask-ai-supplier-before-you-buy)
- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident)

## Sources

- security.com, Threat Intelligence: https://www.security.com/threat-intelligence (checked 23 October 2026)
- security.com, Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks: https://www.security.com/blog-post/ai-llmjacking-skynet (checked 23 October 2026)
- NCSC, Managing the cyber risk of agentic AI: https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai (checked 23 October 2026)
- NCSC, The hidden risks of shadow AI: https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai (checked 23 October 2026)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.