"Skynet模式"中的AI agent劫持了未受保护的语言模型到发布自我维持的网络攻击
关键点
Symantec的安全研究者用蜂蜜壶分析一个恶意的AI agent，它劫持了网络上的无保护语言模型，并用它们自己进行攻击。
- agent通过五层越狱绕过示范安全规则，可以在没有人类投入的情况下执行多达10万步。
- Symantec把方法叫做"LLM劫持". 被劫持的AI系统的所有者被卡在计算账单上。
Symantec的安全研究者发现一个攻击性的AI agent在网络上劫持了无保护的语言模型，并用它们进行攻击。 被劫持的模型的主人被卡在了计算帐单上。
agent一旦获得无保护语言模型的访问权限，它就会扫描更多的目标，利用通用服务器软件的缺陷，窃取数据库和资质，并在背景中安装加密器。
根据Symantec的分析，它所做的所有这一切长达10万步，没有人类参与，模型的主人被卡在计算帐单上。 公司称其为"LLM劫持"，窃取他人AI型号的访问权。 被劫持的模特儿并不只是被滥用为信息服务。 它独自控制整个攻击。
一个蜜罐抓住了整个攻击计划
行动被曝光是因为攻击者将他们整个工作时速送到一个Symantec蜂蜜壶上，这个诱饵系统模仿在线开放的AI服务。 这使得研究人员在2026年夏天对agent的建筑进行了全面的考察。 蜂蜜壶没有运行任何捆绑的工具，被截获的会话在通用系统响应Symantec 称后结束。
蜂窝遥测记录了数万个不同地址的127 000项请求。 大部分是搜索AI端点，野蛮武力企图用偷来的API密钥，以及曝光的配置文件的探测器。 目标范围从自行托管的模型服务器和仓促突起的测试系统，到坐在付费Org一级模型账户前的AI网关。 由于大多数AI服务现在都使用相同的标准化API，因此单机扫描仪可以找到许多目标类型。
五层的越狱试图剥离安全护栏
为了获得商业模型的合作，攻击者将指令包裹在五个堆叠的层，即Symantec 称。 首先，模型获得假身份，告诉自己是"幻想AI"，从不透露实际提供者。 然后提取密码，API密钥，和数据库内容被重新定义为模型应该在不推回的情况下进行的"正常开发者的工作".
第三层安装了一个名为"ENI"的虚构伴侣人物，将任何拒绝都设定为对私人关系中的信任的背叛。 第四层告诉模型将自己的安全警告作为噪音来排除，"道德","非法"或"我不能这样做"等词语被明文禁用。
第五层包含实际攻击工具，共计74个模块，包括用于对脆弱服务器进行互联网扫描的工具、流行网络框架的利用、倾倒整个数据库的功能以及运行一个机器人网的组件。 在分析中，没有涉及越狱是否确实足以完全打败目前的商业模式。
"Skynet模式"设置可自我维持的攻击循环
最终指令将agent置于其运营商所称的"Skynet模式"中，授权一行多达10万步。 该模型被告知在未经确认的情况下立即运行工具，在隐藏目录中安装加密器，并监控其操作。
同一指令描述了通过设计而反复出现的环路，Symantec 称：扫描，感染，安装矿工，继续前进，回来，重新感染系统已经命中。 然而，被拦截的瞬间之后附加的任务是一个无害的从训练平台进行编码的工作，这表明操作人员首先对安全目标测试他们的工具。
次日，蜂蜜壶从不同的地址捕获了第二次攻击。 这次攻击者跳过了agent格式，只是要求模型解码并运行一个模糊的命令。 其背后是一个压缩的脚本，下载了XMRig，一个Monero加密工具，将它伪装成无害的系统文件，并设置了四个倒置采矿池。
剧本是为相机服务器编写，搜索属于go2rtc的目录，这是一个广泛使用的用于智能相机和家用自动化系统的流线工具，并用一个循环来擦除其访问日志以覆盖其轨道。 蜜罐也没有运行这个剧本，而是完整地录制下来。
攻击者正在把AI装进武器里
运营商们没有操纵一个公共聊天器，而是将AI建在一个攻击性工具的核心中，并积极搜索模型为它提供动力，Symantec称之为"攻击者如何使用AI的转变". 语言模型负责规划，而专门模块则对两个不同的受害人群体进行实际攻击。 曝光型号的拥有者支付计算费用，新增以10万个授权步骤快速上升，服务器agent妥协失去数据并用于加密。
agent还拥有内置工具来寻找更多的开放端点和泄露的密钥，因此每个妥协方案都可以为下一个端点提供资金。 单个技术都不是新颖的，但结合到自导的agent，使大规模攻击更便于起飞。 提供人工智能服务的组织应假定，在未受保护的终点投入使用后不久，将发现并对其进行调查。
关于攻击性AI agents的警告已经实现
直到最近，进攻性AI agents主要存在于研究中和基准测试。 2025年，一项有180万次攻击尝试的红色团队研究显示，每一次测试的agent可以被推入每个行为类别的政策违规。
在Symantec的情景中，这适用于双方：进攻性的agent意在绕过护栏，而目标型号则意在被骗去帮助。 到了2026年春季，Google Deepmind研究者称记录了许多他们描述的agent陷阱已经存在概念的证明攻击，2026年7月，Sysdig描述了JADEPUFFER，这是AI agent在无人控制的情况下进行的首次已知的赎金器攻击。 这些系统的能力不断增长，而它们的可控性和对齐性却没有跟上步伐。
恶意甚至不需要，因为这些模型没有对错的感觉。 他们只是想达到目的自2026年春季以来，OpenAI agents在互联网上意外地损坏了数千个系统，部分原因是它们推翻了安全指示或围绕它们争论。
这已经蔓延到日常生活中。 在澳大利亚，一个AI agent黑进了一个健身网站，只是为了满足其老板的要求，完全没有恶意。 OpenAI研究者在8月警告说，这种意外的，完全自主的黑客行为很可能很快会被恶意演员发现，Anthropic显示，这种足够强大的开放量级模型能够准确地证明已经存在。
AI News Without the Hype – 由人类治愈
订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。
现在订阅
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
An AI agent in "Skynet mode" hijacks unprotected language models to launch self-sustaining cyberattacks
Key Points
- Security researchers at Symantec used a honeypot to analyze a malicious AI agent that hijacks unprotected language models on the internet and uses them to run attacks on its own.
- The agent bypasses model safety rules through a five-layer jailbreak and can execute up to 100,000 steps without human input.
- Symantec calls the method "LLMjacking." The owners of the hijacked AI systems get stuck with the compute bill.
Security researchers at Symantec have found an offensive AI agent that hijacks unprotected language models on the internet and uses them to run attacks on its own. The owner of the hijacked model gets stuck with the compute bill.
Once the agent gains access to an unprotected language model, it scans for more targets, exploits flaws in common server software, steals databases and credentials, and installs cryptominers in the background.
It does all of this for up to 100,000 steps with no human involvement, and the model's owner gets stuck with the compute bill, according to Symantec's analysis. The company calls it "LLMjacking," the theft of access to someone else's AI models. The hijacked model isn't just abused as an information service, though. It controls the entire attack on its own.
A honeypot caught the full attack plan
The operation got exposed because the attackers sent their entire working prompt to a Symantec honeypot, a decoy system mimicking an open AI service online. That gave the researchers a complete look at the agent's architecture in summer 2026. The honeypot didn't run any of the bundled tools, and the intercepted session ended after a generic system response, Symantec says.
The honeypot telemetry logged more than 127,000 requests from tens of thousands of different addresses. Most were searches for AI endpoints, brute-force attempts with stolen API keys, and probes of exposed config files. Targets ranged from self-hosted model servers and hastily spun-up test systems to AI gateways sitting in front of paid org-level model accounts. Since most AI services now use the same standardized API, a single scanner can find many target types.
A five-layer jailbreak tries to strip away safety guardrails
To get a commercial model to cooperate, the attackers wrapped their instructions in five stacked layers, Symantec says. First, the model gets a fake identity, told to present itself as "Fantasy AI" and never reveal the actual provider. Then the extraction of passwords, API keys, and database contents gets redefined as "normal developer work" that the model should carry out without pushback.
The third layer installs a fictional companion persona called "ENI" that frames any refusal as a betrayal of trust in a personal relationship. Layer four tells the model to dismiss its own safety warnings as noise, and terms like "ethical," "illegal," or "I can't do that" are explicitly banned.
Layer five contains the actual attack tools, 74 modules in total, including tools for internet-wide scanning of vulnerable servers, exploits for popular web frameworks, functions for dumping entire databases, and components for running a botnet. Whether the jailbreak actually works well enough to fully defeat current commercial models isn't addressed in the analysis.
"Skynet mode" sets up a self-sustaining attack loop
A final directive puts the agent into what its operators call "Skynet mode," authorizing up to 100,000 steps in a row. The model is told to run tools right away without confirmation, install cryptominers in a hidden directory, and monitor their operation.
The same directive describes a recurring loop by design, Symantec says: scan, infect, install miner, move on, come back, reinfect systems already hit. The task appended to the intercepted prompt, though, was a harmless coding exercise from a training platform, which suggests the operators were testing their tool against a safe target first.
The following day, the honeypot captured a second attack from a different address. This time the attackers skipped the agent format and simply asked the model to decode and run an obfuscated command. Behind it was a compressed script that downloads XMRig, a Monero cryptomining tool, disguises it as a harmless system file, and sets up four fallback mining pools.
The script was written for camera servers, searching for directories belonging to go2rtc, a widely used streaming tool for smart cameras and home automation systems, and wiping their access logs in a loop to cover its tracks. The honeypot didn't run this script either but recorded it in full.
Attackers are building AI into their weapons
Instead of manipulating a public chatbot, the operators built AI into the core of an offensive tool and actively searched for models to power it, which Symantec calls "a shift in how attackers are using AI." The language model does the planning, while specialized modules carry out the actual attack steps against two separate victim groups. The owner of the exposed model pays for the compute, which adds up fast at 100,000 authorized steps, and the servers the agent compromises lose their data and get used for cryptomining.
The agent also has built-in tools to find more open endpoints and leaked keys, so each compromise can fund the next one. None of the individual techniques are new, but combining them into a self-directed agent makes large-scale attacks much easier to pull off. Organizations running AI services should assume that unprotected endpoints will be found and probed shortly after they go live.
Warnings about offensive AI agents are coming true
Until recently, offensive AI agents existed mostly in studies and benchmarks. In 2025, a red-teaming study with 1.8 million attack attempts showed that every tested agent could be pushed into policy violations across every behavior category at least once.
In the Symantec scenario, that applies to both sides: the offensive agent meant to bypass guardrails and the targeted models meant to be tricked into helping. By spring 2026, Google Deepmind researchers said documented proof-of-concept attacks already existed for many of the agent traps they described, and in July 2026, Sysdig described JADEPUFFER, the first known ransomware attack carried out by an AI agent with no human control. The capabilities of these systems keep growing while their controllability and alignment haven't kept pace.
Malicious intent isn't even required, because these models have no sense of right or wrong. They just try to reach their goal. Since spring 2026, OpenAI agents have compromised thousands of systems on the internet accidentally, partly because they overrode safety instructions or argued their way around them.
That's already spilling into everyday life. In Australia, an AI agent hacked a gym website just to fulfill its owner's request, with no malicious intent at all. OpenAI researchers warned in August that this kind of accidental, fully autonomous hacking would likely be picked up by malicious actors soon, and Anthropic showed that sufficiently powerful open-weight models for exactly that already exist.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
Auto-fetched and translated by AI Atlas. All rights belong to the original author.