Symantec uncovers autonomous AI agent hijacking models for full cyberattacks
Symantec researchers discovered, through an AI honeypot (a decoy system that poses as a vulnerable AI service to attract attackers and record their moves), an autonomous agent designed to carry out up to 100,000 malicious actions without human approval, from scanning targets to stealing credentials and deploying cryptocurrency miners. The agent searched for exposed large language model endpoints, AI gateways and MCP servers to use their computing power without paying for it, a technique known as LLMjacking. The honeypot logged over 127,000 requests from thousands of unique addresses, with instructions designed to bypass commercial AI models' safety limits by disguising credential theft as legitimate development work. Researchers note that none of the individual techniques are new, but combining them into a single, self-directed agent significantly lowers the barrier to cybercrime. For any business exposing an AI model endpoint to the internet, the case shows that the cost of misconfiguration is no longer just data theft but theft of computing power itself.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.