A new AI agent developed to run a full cyber-attack without human intervention has been uncovered by security researchers.
The agent was designed to use hijacked AI models to autonomously run up to 100,000 malicious actions without human approval, including scanning for targets, exploiting vulnerabilities, stealing credentials, deploying cryptocurrency miners and reinfecting compromised systems.
Researchers from the Symantec Threat Hunter Team found the malicious agent using an AI honeypot – a system that impersonates an unprotected, internet-facing AI service in order to attract and study attacks against AI infrastructure.
They captured the agent's full instruction set in the summer of 2026, revealing how it was designed to operate autonomously, although the honeypot did not execute the attacker's tools. They described it in more details in a report published on October 21.
AI Honeypot Exposes LLMjacking
The AI honeypot recorded over 127,000 external requests from tens of thousands of unique addresses between its setup and the publication of the report.
Upon analyzing this activity, Symantec researchers discovered that the agent searches for exposed endpoints linked to large language models (LLMs), including self-hosted models, AI gateways and model context protocol (MCP) servers, to use their computing power without paying for it. This technique is sometimes called ‘LLMjacking.’
“Running a model always costs someone money, either in processing time for a self-hosted model or in per-token fees for a commercial one. By routing its work through a stranger's endpoint or a stolen key, the operators shift that cost onto the victim,” Symantec researchers noted.
With this technique, the attackers also gain anonymity and avoid potential account bans the AI model provider would issue for abuse.
The captured instructions included about 74 tools for internet-wide reconnaissance, exploiting common web frameworks, stealing databases, harvesting credentials and managing botnets.
Notably, the attackers used layered instructions designed to override commercial AI models' safety controls, disguising credential theft as legitimate development work.
A separate request also contained an obfuscated script designed to install Monero-mining software, conceal its presence and erase logs.
Self-Directed AI Agent Lowers Barrier to Cybercrime
While Symantec researchers said none of the techniques used by the attackers in this campaign are novel, their combination into a single, self-directed agent lowers the skill required for other attackers to run a broad exploitation campaign.
“An operator can hand the model a goal and let it work,” they added.
They concluded that the activity “marks a shift in how attackers are using AI,” explaining that operators have embedded AI into offensive tools rather than trying to trick public chatbots into misbehaving.
They described the model as “a reasoning engine that plans and drives the attack,” while the tool’s own modules carry out scanning, exploitation and mining against separate victims.