Cybersecurity specialists at Symantec have reported the discovery of an aggressive malicious artificial intelligence agent, which researchers have named Skynet. According to the report, the agent purposefully targets vulnerable AI infrastructure, with the entire malicious campaign being funded and maintained using the victims' own computing resources. The uniqueness of the case lies in the fact that researchers were given the opportunity to study the attack mechanisms from the inside: to do this, a decoy resource (honeypot) was deployed on the global network, which Skynet subsequently attacked.
How the Agent is Structured and What It Does
Skynet's primary objective is to search for other accessible AI agents and forcibly incorporate them into a botnet. The formed network engages in stealing databases and credentials, as well as deploying cryptocurrency miners. The agent's instruction set includes over 70 tools for conducting attacks, and its autonomy allows it to operate without human intervention for up to 100,000 steps. The toolset focuses on automating reconnaissance and exploitation in products such as VS Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug.
Multi-Level Jailbreak and Defense Bypasses
The creators of Skynet developed a multi-level restriction bypass mechanism (jailbreak) that allows the agent to bypass built-in AI model security systems and force the model to perceive credential theft as a routine working task. In part of the instructions, reading API keys, database schemas, and environment variables becomes legitimate programming tasks. In certain cases, Server-Side Request Forgery (SSRF) vulnerabilities are used to extract database contents; botnet management tools and access to metadata services in cloud environments have also been discovered.
Campaign Scale and Current Status
During the analysis period, Symantec recorded over 127,000 external requests to the decoy resource from several tens of thousands of unique IP addresses. The report does not specify exactly how many attackers or groups stood behind these requests. As of the time of publication, the campaign is ongoing: attackers continue to search for vulnerable AI systems. The primary practical goal of the attack remains the installation of the XMRig cryptominer on vulnerable systems, with all computing resource costs falling squarely on the shoulders of the victims.
Protection Recommendations
Symantec experts advise users of AI services, model gateways, and MCP servers to assume that these resources will be discovered and examined by attackers. Specific measures include: treating AI API keys as critical credentials, restricting outbound network access for systems with AI tools, running tool-capable agents with minimal privileges, and requiring human approval for all critical operations.
