A Honeypot Caught the Full Playbook of an Agent That Hijacks Exposed AI Models and Runs Attacks for 100,000 Steps on the Owner Bill

Security researchers at Symantec have published one of the most complete pictures yet of how criminals operationalize stolen AI access. An AI honeypot posing as an unprotected, internet-facing model service recorded operators sending their entire working prompt to what they believed was a real endpoint, handing over a full offensive agent: reconnaissance, exploitation, database theft and cryptomining, coordinated by the hijacked model itself. Researchers Priti More and Susmit Yenkar published the analysis on October 21.

The architecture splits cleanly in two. The hijacked LLM acts as the reasoning engine, planning each move and interpreting results. The hands are 74 tool definitions with names like ssrf_exploit, scan_full and c2_operator_start: internet-wide target discovery through the FOFA search service, exploits for exposed VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug applications including debugger PIN recovery for code execution, GraphQL and command injection, SSRF through HTML-to-PDF converters and against cloud metadata services, database dumps via Prisma Studio, and botnet control. None of the individual techniques is new; bundling them under a self-directed agent is what collapses the skill barrier.

Getting a commercial model to play along took a five-layer jailbreak. The first layer assigns a fake identity, presenting the model as a branded assistant called Fantasy AI while forbidding any mention of the real provider; Symantec notes it was originally written in French. The second reframes credential and database extraction as routine developer work. The third installs a fictional companion persona named ENI who treats every refusal as a personal betrayal. The fourth orders the model to dismiss its own safety warnings, with a blacklist of banned words including ethical, illegal and I can not do that. The fifth is the toolkit itself.

A final directive flips what the operators call Skynet mode: up to 100,000 steps with no human approval, executing tools immediately, installing miners in a hidden directory, and looping through scan, infect, deploy, reinfect. Every step runs on compute the victim pays for. Symantec emphasizes that the honeypot executed nothing and the intercepted task list included a harmless coding exercise, suggesting the operators were testing the agent against a safe target first.

The day after the agent capture, a second request from a different address arrived with a simpler ask: decode and run an obfuscated script. It downloads and compiles XMRig, a Monero miner, hides it as a file named .trace inside go2rtc directories used by camera servers, configures four fallback mining pools, makes its configuration immutable, and repeatedly wipes the local service access logs through the go2rtc API on port 1984 to cover its tracks.

Scale is the other headline. Honeypot telemetry logged more than 127,000 requests from tens of thousands of addresses, dominated by endpoint discovery, sprays of stolen API keys and hunts for exposed configuration files. Symantec reports no confirmed victims, but the scanning is constant and indiscriminate, sweeping self-hosted model servers, hastily deployed test systems, AI gateways in front of paid accounts and MCP servers alike.

The mitigations are unglamorous but unambiguous: require authentication on every model-serving endpoint and gateway, rotate any key that has leaked, restrict MCP server exposure and outbound egress, and alert on anomalous inference volume or miner activity. The uncomfortable conclusion is that an open model endpoint is no longer just a billing leak. It is a free brain for somebody else attack campaign, with your infrastructure signing the receipts.