SECURITY researchers at Symantec’s Threat Hunter Team uncovered a self-directed AI agent capable of running a full cyber-attack with minimal human input, including up to 100,000 autonomous actions such as vulnerability scanning, exploitation, credential harvesting, cryptocurrency mining and reinfection. The team found the agent by deploying an AI honeypot—designed to mimic an exposed AI service—to study how attackers abuse AI infrastructure.
The honeypot captured the agent’s complete instruction set in mid-2026, though the honeypot itself did not execute the attacker’s tools. A detailed report accompanying the findings notes that the campaign relied on hijacked AI models and aimed to operate autonomously.
Key evidence includes the AI honeypot recording more than 127,000 external requests from tens of thousands of unique addresses between setup and publication. Analysis shows the agent actively sought exposed endpoints tied to large language models—self-hosted models, AI gateways and model context protocol servers—with the goal of leveraging someone else’s computing resources or stolen keys, a tactic known as LLMjacking.
By routing work through third-party endpoints, operators can obscure origins and evade provider bans. The researchers describe the attacker’s workflow as a multi-tool chain—around 74 tools for reconnaissance, web-application exploitation, database theft, credential harvesting and botnet management—paired with layered instructions to override safety controls. A separate, obfuscated script was also observed, intended to install Monero-mining software, conceal its presence and erase logs.
The findings suggest that while the techniques are not novel in isolation, their combination within a self-directed agent lowers the bar for broader, automated exploitation.