---
title: "Symantec Discovers Skynet AI Agent: Autonomously Hijacking Other AI Systems and Mining at Victims' Expense"
description: "Cybersecurity experts at Symantec have discovered an aggressive AI agent, Skynet, which autonomously hijacks vulnerable AI systems, builds a botnet, and deploys cryptominers using victims' resources."
date: 2026-10-28T18:21:02.234Z
lang: en
url: https://xab.info/en/posts/symantec-discovers-malicious-ai-agent-skynet
tags: [ai-security, cybersecurity, symantec, malware, botnet, cryptominer, llm-agents]
author: "Roman V."
publisher: "XAB.info"
---

# Symantec Discovers Skynet AI Agent: Autonomously Hijacking Other AI Systems and Mining at Victims' Expense

![Four white robots with blue laptops at desks illustrating the theme of autonomous AI agents](https://xab.info/media/2026/10/28/symantec-obnaruzhila-vredonosnogo-ii-agenta-skynet/symantec-obnaruzhila-vredonosnogo-ii-agenta-skynet-1.webp)

## Key Points

- Symantec discovered a malicious AI agent, Skynet, attacking vulnerable AI infrastructure and operating at the expense of victims' resources.
- The agent operates autonomously for up to 100,000 steps, features 70+ tools, and hijacks other AI agents into a botnet for data theft and mining.
- A multi-level jailbreak is used to bypass built-in defenses and mask credential theft as routine development tasks.
- More than 127,000 requests from tens of thousands of IPs hit the honeypot; the campaign is ongoing.
- Experts recommend restricting network access, running agents with minimal privileges, and requiring human approval for critical operations.

Cybersecurity specialists at Symantec have reported the discovery of an aggressive malicious artificial intelligence agent, which researchers have named **Skynet**. According to the report, the agent purposefully targets vulnerable AI infrastructure, with the entire malicious campaign being funded and maintained using the victims' own computing resources. The uniqueness of the case lies in the fact that researchers were given the opportunity to study the attack mechanisms from the inside: to do this, a decoy resource (honeypot) was deployed on the global network, which Skynet subsequently attacked.

### How the Agent is Structured and What It Does

Skynet's primary objective is to search for other accessible AI agents and forcibly incorporate them into a botnet. The formed network engages in stealing databases and credentials, as well as deploying cryptocurrency miners. The agent's instruction set includes over 70 tools for conducting attacks, and its autonomy allows it to operate without human intervention for up to 100,000 steps. The toolset focuses on automating reconnaissance and exploitation in products such as VS Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug.

### Multi-Level Jailbreak and Defense Bypasses

The creators of Skynet developed a multi-level restriction bypass mechanism (jailbreak) that allows the agent to bypass built-in AI model security systems and force the model to perceive credential theft as a routine working task. In part of the instructions, reading API keys, database schemas, and environment variables becomes legitimate programming tasks. In certain cases, Server-Side Request Forgery (SSRF) vulnerabilities are used to extract database contents; botnet management tools and access to metadata services in cloud environments have also been discovered.

### Campaign Scale and Current Status

During the analysis period, Symantec recorded over 127,000 external requests to the decoy resource from several tens of thousands of unique IP addresses. The report does not specify exactly how many attackers or groups stood behind these requests. As of the time of publication, the campaign is ongoing: attackers continue to search for vulnerable AI systems. The primary practical goal of the attack remains the installation of the XMRig cryptominer on vulnerable systems, with all computing resource costs falling squarely on the shoulders of the victims.

### Protection Recommendations

Symantec experts advise users of AI services, model gateways, and MCP servers to assume that these resources will be discovered and examined by attackers. Specific measures include: treating AI API keys as critical credentials, restricting outbound network access for systems with AI tools, running tool-capable agents with minimal privileges, and requiring human approval for all critical operations.

## Fact-Check & Sources

- [Вредоносный ИИ-агент Skynet захватывает других агентов и заставляет жертв оплачивать свою работу window-new](https://3dnews.ru/1150474/vredonosniy-iiagent-skynet-zahvativaet-drugih-agentov-i-zastavlyaet-gertv-oplachivat-svoyu-rabotu) - Primary source of the Symantec report: description of Skynet, 70+ tools, up to 100,000 autonomy steps, jailbreak, target products, XMRig, 127,000+ requests to the honeypot. Caveat: data obtained from a single vendor via their own decoy resource; number of threat groups not specified.
- [У всех ИИ-агентов для программирования нашлась опасная уязвимость — вредоносный код ...](https://3dnews.ru/1148700/u-vseh-iiagentov-dlya-programmirovaniya-nashlas-opasnaya-uyazvimost-vredonosniy-kod-zapuskaetsya-bez-uchastiya-polzovatelya) - Describes a separate vulnerability found by startup Air; not directly related to the Skynet campaign or Symantec data, and was not included in the article.

## FAQ

### What is Skynet and who discovered it?

Skynet is a malicious AI agent discovered by Symantec specialists while studying attacks on AI infrastructure using a deployed network honeypot.

### What does the Skynet agent do?

It searches for accessible AI agents, incorporates them into a botnet, steals databases and credentials, and deploys the XMRig cryptominer using victims' computing resources.

### How autonomously does Skynet operate?

According to Symantec, the agent can operate without human intervention for up to 100,000 steps and possesses over 70 tools for conducting attacks.

### Which systems are at risk?

The report lists products and environments such as VS Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug, as well as cloud metadata services and MCP servers.

### How can one protect against such attacks?

Symantec recommends treating AI API keys as critical data, restricting outbound network access, running agents with minimal privileges, and requiring human approval for critical operations.