Symantec Uncovers AI Agent Capable of Autonomous Cyber-Attacks
Symantec researchers have discovered a sophisticated AI agent designed to execute entire cyberattacks autonomously, leveraging hijacked large language models (LLMs) for reconnaissance, exploitation, and more.
Security researchers from Symantec's Threat Hunter Team have uncovered a novel AI agent capable of orchestrating and executing full cyberattacks without any human intervention. This autonomous agent was designed to hijack existing AI models, specifically large language models (LLMs), to perform a wide array of malicious actions, potentially numbering up to 100,000, without requiring explicit human approval at any stage.
The discovery was made using an AI honeypot, a security mechanism designed to mimic an unprotected, internet-facing AI service. This setup successfully attracted and allowed researchers to analyze attacks targeting AI infrastructure. The Symantec team captured the agent's complete instruction set during the summer of 2026, providing a detailed look into its autonomous operational design, though the honeypot itself did not execute the attacker's deployed tools.
The AI honeypot recorded an extensive volume of activity, with over 127,000 external requests originating from tens of thousands of unique IP addresses between its deployment and the report's publication. Analysis revealed that the agent actively searches for exposed endpoints associated with LLMs. This includes self-hosted models, AI gateways, and servers utilizing the Model Context Protocol (MCP). The objective is to utilize the computing power of these hijacked models without incurring any costs, a technique often referred to as 'LLMjacking'.
Symantec researchers highlighted that LLMjacking serves a dual purpose for attackers: it shifts the financial burden of running AI models onto the victim, whether through processing time for self-hosted instances or per-token fees for commercial services. Furthermore, it provides a layer of anonymity, helping attackers evade detection and potential account bans that AI model providers would typically issue for abusive behavior.
The captured instructions detailed approximately 74 tools dedicated to broad internet-wide reconnaissance, exploiting common web frameworks, extracting databases, harvesting credentials, and managing botnets. A particularly concerning aspect was the use of layered instructions designed to circumvent the safety controls of commercial AI models. These instructions disguised sensitive operations, such as credential theft, as legitimate development tasks, making them harder to flag.
In addition to its core attack capabilities, a separate request within the captured data contained an obfuscated script. This script was designed to install Monero-mining software, conceal its presence on the compromised system, and systematically erase any logs that could indicate its activity, further enhancing its stealth.
While Symantec noted that the individual techniques employed by this agent are not entirely new, their integration into a single, self-directed entity significantly lowers the barrier to entry for other threat actors. This consolidation allows operators to simply provide a high-level goal, such as compromising a specific target or stealing data, and let the AI agent devise and execute the necessary steps autonomously.
The development signifies a notable shift in how attackers are leveraging AI. Instead of attempting to trick public chatbots into performing malicious actions, operators are now embedding AI directly into offensive tools. This agent acts as a sophisticated 'reasoning engine' that plans and directs the attack, while its integrated modules handle the execution of tasks like scanning, exploitation, and cryptocurrency mining against various victims.