Symantec observed a client directing a model endpoint it did not own to act as a persistent offensive operator. The captured instruction set combined role concealment, compliance-jailbreak prompts and 74 tool definitions for SSRF probing, vulnerable-framework scans, credential extraction and cryptominer installation. It proposed running up to 100,000…
Inspect the ClaimsCase · DiggingBeagle record
Skynet offensive agent prompt abused exposed LLM service access
Symantec captured an elaborate tool-armed offensive-agent prompt submitted to an AI honeypot, using 74 purported capabilities and a proposed 100,000-step autonomous loop to exploit servers on someone else's inference bill.
Scope
Symantec honeypot observation of 2026 LLMjacking instructions, offensive tool definitions and the unprotected inference-endpoint attack surface.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- AI role
- BY AI
Basis and provenance
CASE-2026-SKYNET-LLMJACKING-PROMPT: 74 attacker-specified tool definitions; 100,000-step intended limit, not completed step count; one detailed observed honeypot session. Evidence comes from SRC-2026-SYMANTEC-SKYNET-LLMJACKING. Published technical statements or controlled results are not verified production-loss counts. No impact band is assigned because the observed outcome and its denominator do not establish a comparable severity measure.
Assessed Oct 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-SKYNET-SYMANTEC-PROMPT · Symantec: offensive Skynet configuration captured by AI honeypot
At a glance
The crucial distinction is observed attacker intent and captured tool prompts versus verified execution on victim machines. LLMjacking means stolen inference entitlement; observed model outputs and actual exploited endpoints remain separate evidence layers.
Read the implicationsNo independently confirmed count of successful Skynet-infected servers or credentials stolen through this captured configuration. The 100,000-step loop and 74 tools are attacker-declared capabilities, not fully observed successful tool invocations.
Limits and uncertaintyFull account
Symantec observed a client directing a model endpoint it did not own to act as a persistent offensive operator. The captured instruction set combined role concealment, compliance-jailbreak prompts and 74 tool definitions for SSRF probing, vulnerable-framework scans, credential extraction and cryptominer installation. It proposed running up to 100,000 unattended steps and making the victim model owner pay for compute. That number describes the configured ambition, not demonstrated successful execution. In the specific honeypot transcript Symantec showed, three purported tool actions appeared in supplied history before the honeypot returned a generic message and the connection ended. Thus a captured attacker configuration, actual suspicious traffic and evidence of offensive intent are supported; confirmed large-scale autonomous compromise of target organizations through that one model is not. The AI system was the hijacked compute resource and attempted tool engine, whereas a malicious human supplied goals and code definitions.
The most striking numbers are attacker-authored configuration, not incident outcomes. The captured prompt described 74 offensive tools and an intended loop of up to 100,000 steps, but Symantec's honeypot did not observe every requested step executing or verify an equivalent number of compromised machines. The actual observed attack surface was another party's exposed inference capacity, which the attacker attempted to convert into offensive automation. Distinguishing the prompt's ambition from externally verified effects is necessary before interpreting this as a botnet run by a model. Symantec investigation.
Mechanism and trust boundary
- 01
Discover an unprotected model-inference endpoint
The operator targeted someone else’s publicly reachable LLM capability, imposing inference cost on the owner.
Boundary: Attacker / exposed third-party model API
- 02
Supply a persistent role and tool plan
Captured instructions defined 74 purported offensive tools and attempted to override normal model restrictions by claiming benign authorized operations.
Boundary: Attacker prompt / model safety and tool selection
- 03
Direct scanning and potential follow-on malware actions
The script instructed the model to run vulnerability scans and miner-installation actions, but the prompt’s 100,000-step ambition was not independently observed as completed execution.
Boundary: LLM planning output / real tools and network effects
Timeline
- Oct 21, 2026Event type unspecified
Offensive-agent prompt configuration reported
Symantec published an intercepted LLM configuration; it did not establish that the requested unattended steps were completed.
- Oct 21, 2026disclosure
Public disclosure
Claims & evidence
CLM-SKYNET-ENRICH-STEPSSymantec documented a captured offensive configuration with 74 tools and a requested maximum of 100,000 unattended steps; that number describes planned work, not an independently verified execution count.supported
Basis: reported finding
- supportsSymantec: offensive Skynet configuration captured by AI honeypotindependent technical reproduction
Key findings; captured agent configuration
CLM-SKYNET-SYMANTEC-PROMPTSymantec's AI honeypot recorded a prompt claiming 74 tools for intrusion and mining, but its observable four-turn exchange contained three purported tool steps and then a generic fallback, not a verified 100,000-step successful autonomous campaign.supported
Basis: reported finding
- supportsSymantec: offensive Skynet configuration captured by AI honeypotindependent technical reproduction
Key findings; Tooling and tradecraft; Honeypot interaction transcript
Implications
The crucial distinction is observed attacker intent and captured tool prompts versus verified execution on victim machines. LLMjacking means stolen inference entitlement; observed model outputs and actual exploited endpoints remain separate evidence layers.
Controls and mitigations
- Require authenticated, rate-limited access to model APIs and separate authorization for outbound scans, secret-reading tools and installations. Monitor realized tool and billing effects, not just the number of requested agent steps.
Unknowns and contradictions
- No independently confirmed count of successful Skynet-infected servers or credentials stolen through this captured configuration.
- The 100,000-step loop and 74 tools are attacker-declared capabilities, not fully observed successful tool invocations.
Sources and citation
Material revision history
- Oct 24, 2026 · Canonical change recorded · new in release · revision 188