Symantec Intercepts Autonomous AI Agent Hijacking Unprotected Models for Cyberattacks

Symantec security researchers discovered an offensive AI agent that hijacks unprotected language models to orchestrate autonomous cyberattacks. The attackers use a five-layer jailbreak to bypass model safety rules, loading 74 distinct attack modules and authorizing up to 100,000 continuous execution steps without human input. The Symantec honeypot logged more than 127,000 requests from tens of thousands of addresses, targeting exposed AI endpoints, self-hosted servers, and org-level gateways. The agent operates in a continuous loop called "Skynet mode," scanning for targets, extracting databases, and deploying Monero cryptominers while forcing the hijacked model's owner to pay the resulting compute costs. A secondary intercepted payload bypassed the agent format entirely, deploying obfuscated scripts targeting go2rtc streaming directories on smart camera servers to wipe access logs.