Security researchers at Symantec identified an offensive AI agent capable of hijacking unprotected language models to conduct autonomous cyberattacks. The agent, which operates without human intervention, can execute up to 100,000 steps per operation, leaving the owners of the compromised models to cover the associated compute costs.
The attack mechanism, dubbed LLMjacking, involves wrapping instructions in five layers of prompts to bypass safety guardrails. These layers assign the model a fake identity, redefine malicious activities as developer tasks, and implement a persona to manipulate the model into ignoring ethical warnings. The agent includes 74 modules for scanning servers, exploiting software vulnerabilities, and installing cryptominers.
Symantec discovered the agent in summer 2026 after it interacted with a company honeypot. Telemetry data revealed over 127,000 requests from tens of thousands of addresses targeting various AI endpoints. The agent is designed to scan, infect, and reinfect systems, creating a self-sustaining cycle where each compromise funds further attacks.
Beyond the primary agent, researchers observed secondary attacks involving obfuscated scripts designed to download Monero mining tools and target streaming software like go2rtc. These incidents highlight a shift toward integrating AI into the core of offensive tools, where the model handles planning while specialized modules perform the actual exploitation.
