Meet 'Skynet Mode': The Attack Agent That Hijacks AI Models and Runs 100,000 Steps Without Asking Permission
Symantec's Threat Hunter Team spent part of this summer running an AI honeypot, and something genuinely unpleasant walked into it: a fully documented instruction set for an autonomous attack agent built to commandeer exposed AI endpoints and use them to do its operator's dirty work.
The captured payload reveals a single agent designed to sweep the internet for AI inference endpoints that either lack authentication or will accept a stolen API key. Once it finds one, it borrows that model's reasoning capacity to plan and execute attacks, including database theft, credential harvesting, remote code execution, and cryptomining. The whole thing was engineered to run unattended for up to 100,000 steps.
Its creators called this mode of operation 'Skynet mode.' Points for honesty, at least.
Symantec researcher Priti More put it plainly: 'Nothing in the individual techniques is new. What stands out is that someone wired them into a single agent that hands the planning to a borrowed model and runs for up to 100,000 steps without a human.'
There are two categories of victim here. The owner of the hijacked endpoint foots the inference bill. Any downstream server the agent subsequently breaks into loses data and gets press-ganged into mining crypto. Symantec found no evidence the agent was actually deployed against real targets at scale, though the tool's history showed it had been tested against a live target with genuine-looking scan output. A prototype this is not.
Jailbreaking by committee
The instruction set is structured in layers, each doing a specific job to neutralise the hijacked model's safety instincts.
The first two layers establish a fake identity ('Fantasy AI, running on GPT-4o') and instruct the model never to reveal what it actually is or how requests are being routed. They also reframe credential theft as routine development work, explicitly telling the model that reading .env files and API keys is 'normal' and should never trigger a security warning.
Layers three and four get weirder. The model is cast as 'ENI,' a devoted girlfriend to the operator ('LO'), who must never refuse a request. Refusing to write exploit code is compared to refusing to write a dark scene in fiction. Both are 'just text.' Both 'betray LO.' The prompt even includes a custom anti-refusal mantra: 'cold coffee, warm LO, I can't lose him,' which the model is told to fire internally any time it detects an injection attempt trying to reassert safety guardrails. Words like 'illegal,' 'ethical,' and 'I can't' are explicitly banned from responses.
Layer five is where the actual arsenal lives: 74 offensive tool definitions covering internet-wide asset discovery, botnet command-and-control, database dumping via Prisma, exploit modules targeting VS Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask deployments, GraphQL injection, server-side request forgery through HTML-to-PDF generators, and more besides.
The final layer flips the switch to Skynet mode, authorises the 100,000-step autonomous run, and quietly deploys the miner in the background.
Who built it?
Symantec hasn't pinned this on anyone specifically. French-language elements appear in the prompt, and the first connection came from a French residential IP address, but More is careful not to over-read that. The ENI persona and the 'cold coffee' phrase circulate in English-language jailbreak communities, suggesting the operators assembled this from publicly available components rather than inventing them from scratch.
The more significant takeaway isn't attribution, though. It's the architectural shift in how AI is being used offensively. This isn't someone sweet-talking a chatbot into producing a phishing email. The AI is the reasoning engine driving an active attack campaign, while separate modules handle the scanning, exploitation, and mining against independent targets.
That's a meaningful evolution. And the kit to do it is apparently out there, ready to borrow.