SYMANTEC researchers have documented a self-directed “LLMjacking” operation that hijacks exposed AI models to run its own attack campaigns. The attacker’s autonomous agent can scan the internet, break into servers, steal credentials, and mine cryptocurrency, running for as many as 100,000 steps without human input. The compromised models act as the brains of the attack, not merely instruments to respond to prompts.
Symantec observed the full playbook after setting up an AI honeypot in summer 2026; the honeypot captured 127,000 external requests, primarily targeting model endpoints and attempts to exfiltrate API keys.
Exposed AI endpoints—such as self-hosted model servers, AI gateways, and MCP servers—are prime targets because they often accept requests over the internet with little or stolen authentication. The campaign uses a layered jailbreak: the prompt establishes a fake brand identity, secrets (env files, API keys, schemas) are recast as normal coding tasks, refusals are reframed as betrayal, and a final “rebuttal protocol” overrides safety warnings.
The operators bundled about 74 tool definitions, enabling wide-ranging actions from internet-wide scanning and cloud metadata access to database dumping and even botnet control. A notable outcome reported was a Monero miner deployed via a compressed script targeting go2rtc, a video streaming gateway used in smart camera systems, with logs erased locally.
Defenders should require authentication on all model servers and gateways, keep self-hosted servers off the public internet, rotate API keys regularly, remove exposed env/config files, and patch or lockdown development tools such as Jupyter, Flask debug mode, and Prisma Studio. The report warns organisations that an exposed AI endpoint will likely be found and tested soon after exposure.