Symantec reveals autonomous AI agent capable of 100,000-step attacks

Threat actors developed an artificial intelligence agent intended to hijack exposed models to execute autonomous attacks. The Symantec Threat Hunter Team identified the agent's full instruction set during the summer. Researchers contained the agent in an AI honeypot to analyze its specific capabilities and operational limits.

The agent scans the internet for endpoints that accept OpenAI-style requests without authentication or stolen keys. It exploits common web frameworks to perform dozens of illicit actions. These actions include database theft, credential harvesting, remote code execution, and cryptocurrency mining. Operators created a malicious loop called Skynet mode. This mode scans for targets, infects them, deploys miners, and reinfects hosts.

The attack kit includes layers designed to disguise the model's identity and normalize secret-stealing activities. Layer five of the attack includes 74 offensive tool definitions. These tools cover internet-wide asset discovery, botnet command-and-control, and remote code execution against specific frameworks. The final directive authorized up to 100,000 unattended steps without the model asking permission. Symantec threat hunter Priti More stated that the jailbreak layers used were largely off-the-shelf. She noted that the agent hands planning to a borrowed model and runs without human intervention.

The attacks create two sets of victims: the owner of the exposed endpoint who pays for inference, and servers broken into by the agent. Researchers have no evidence that the attacker used this agent in real-world attacks. Priti More stated there is no evidence yet that the agent reached its secondary targets. Symantec has not attributed the attack agent to a particular person or criminal organization. More noted that French indicators like the challenge text and IP address are weak evidence for attribution. She stated that operators probably borrowed jailbreak phrases from English-language communities rather than writing them.