Security Alert | Symantec Captures 'Skynet' Autonomous Attack Agent Hijacking Exposed LLM/MCP Endpoints for Mass Exploitation and Mining
Symantec's Threat Hunter Team ran a honeypot that impersonated an unprotected AI service and captured a full attack prompt: a 'Skynet mode' agent that searches for exposed LLM, AI gateway, and MCP endpoints, strips a commercial model's safety controls with a layered jailbreak, then drives 74 built-in tools to scan, exploit common web frameworks, steal databases and credentials, and quietly install cryptominers — authorized to run unattended for up to 100,000 steps. Defense: require authentication on every exposed model or MCP endpoint, treat AI API keys as high-value credentials to rotate, and restrict outbound access from hosts running AI tools.