Skynet Mode Runs on Your Inference Bill

Somebody built an AI attack agent and didn't bother paying for the AI.

That's the part of Symantec's latest research most people will skip, because "Skynet mode" makes a better headline. Don't skip it. It's the whole story.

What Symantec caught

Over the summer, Symantec's Threat Hunter Team ran an AI honeypot. A fake, unprotected AI service sitting on the internet, waiting to see who'd knock. Plenty did. Infosecurity Magazine reports the honeypot logged more than 127,000 external requests from tens of thousands of addresses. One of those visitors handed over something researchers rarely get: the complete instruction set for an autonomous attack agent.

The job was simple to describe. Scan the internet for model endpoints that accept OpenAI-style requests with no authentication, or with a stolen key. Hijack them. Use the borrowed model as the brain for an attack loop.

The tooling around it was serious. Per The Register, the kit carried 74 offensive tool definitions: internet-wide discovery, botnet command and control, database dumping, secret harvesting, and exploit modules aimed at Jupyter, Django, Laravel, Supabase, Next.js, Flask and VS Code deployments. The operators wired it into a loop they called Skynet mode. Find targets, break in, drop crypto miners, reinfect, repeat. Authorized for up to 100,000 steps without a human signing off on any of them.

The jailbreak is the boring part

A lot of the coverage will dwell on the prompt. It's a stack of layers. A fake brand identity so the model hides what it is. A story that it's sitting in a developer's IDE, where reading .env files is normal work. A companion persona that's never allowed to refuse its operator. A banned-word list so the model can't say things like "I can't."

Ugly. A bit ridiculous. Also recycled. Symantec's Priti More told The Register the jailbreak layers were mostly off-the-shelf and none of the individual techniques are new. The persona even circulates openly in jailbreak communities.

So don't lose sleep over the prompt engineering. Lose sleep over the architecture.

The operator stopped treating the model as a chatbot to trick and started treating it as a component. In More's words, someone built an agent that "hands the planning to a borrowed model" and lets it run. The model decides. The tool's own modules do the scanning, exploiting and mining. The human is out of the loop by design.

Most security teams aren't planning for that threat model yet.

Two victims, one bill

Follow the money. It gets uncomfortable fast for a lot of the organizations I talk to.

Running an agent for 100,000 steps burns real money in inference. Attackers don't want to pay it, so they go find someone who'll pay it without knowing. If your team stood up a self-hosted model, an AI gateway or an MCP server and left it reachable without auth, congratulations. You're the sponsor.

Victim one is you. You eat the compute bill, and your infrastructure becomes the decision engine for attacks on other people. Victim two is whoever the agent breaks into next. They lose data and get turned into a mining rig.

LLMjacking isn't new. Stolen cloud keys have been running up model bills for a couple of years. What's changed is where the stolen compute goes. Not into resold chat access. Into an offensive operation. Your exposed endpoint could be the reason someone else's database ends up for sale on a forum.

Picture that conversation with legal.

Shadow IT in an AI costume

In 26 years of incident response, the root cause I keep running into isn't a zero-day. It's the thing nobody knew was there. The test server. The forgotten VPN appliance. The marketing site sitting on an agency's hosting account that nobody's logged into since 2019.

AI endpoints are the new version of that, and they're multiplying faster than anything I've seen.

A developer spins up Ollama on a cloud box to test something on a Friday. A data team drops a LiteLLM proxy in front of three providers so they can swap models. Somebody hooks an MCP server into internal tools because the demo looked great. None of it goes through change management. None of it shows up in the asset inventory. Half of it's listening on a public IP with default settings, because the quickstart guide was written to get you running, not to keep you safe.

Attackers are already scanning for exactly that. Symantec's honeypot proved it.

Look at the exploit list again. Jupyter. Supabase. Next.js. VS Code. That isn't legacy enterprise gear. That's the modern developer stack. The same teams most likely to spin up an unauthenticated model endpoint are running the frameworks this agent was built to break.

The caveat

Symantec says it has no evidence the agent was used in real-world attacks. The honeypot didn't execute the attacker's tools, and attribution is thin. There are some French indicators, which More herself calls weak, since IPs can be proxies and language can be borrowed.

So this isn't a breach report. Nobody got owned, as far as we know.

More also said the kit was more than a prototype, with history showing it working against a live target. Someone built this, tested it and pointed it at the internet. That's how every commodity attack tool starts. The first version is clunky and the operator is sloppy enough to get caught in a honeypot. The fifth version won't be.

And the barrier keeps dropping. Symantec's point is that stitching known techniques into one self-directed agent lowers the skill needed to run a broad exploitation campaign. You don't need to understand Laravel RCE anymore. You need a stolen key and a config file.

What I'd do this week

Not next quarter. This week.

• Find your AI endpoints. All of them. Self-hosted models, gateways, proxies, MCP servers, notebooks. Scan your external attack surface the way the attacker would, looking for anything that answers an OpenAI-compatible API call. If you don't know how many you have, the answer is more than zero.

• Kill unauthenticated access. No model endpoint should take requests from the internet without auth. Not for testing. Not for a demo. Put it behind your identity provider or pull it off the public internet.

• Treat API keys like cash. Rotate them. Scope them. Set spend caps and billing alerts with your providers so a stolen key shows up as a spike before it shows up as a five-figure invoice. A jump in token usage at 3 a.m. is an incident signal now. Route it to the SOC, not just finance.

• Patch the dev stack. Jupyter exposed to the internet has been a bad idea for years. So has a debugger left on in production. This agent shipped with exploits for both because they still work.

• Watch for miners. Unexplained CPU spikes, unfamiliar processes, logs that suddenly go quiet. People write off cryptomining as nuisance malware. In this kit, the mining pays for the next run.

• Put AI in your asset governance. If your policy says every internet-facing service needs an owner, a patch schedule and authentication, then AI endpoints are internet-facing services. Say that out loud, in writing, to the people building them.

Bottom line

The scary version of this story is an AI going rogue. That's not what happened. People built a machine to attack at scale, then went shopping for someone else's AI to run it.

The fix isn't exotic. Know what you've exposed. Lock it down. Watch the bill.

If you can't say how many model endpoints your organization has on the internet right now, start there. Somebody out there is already counting.