Threat
Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds
First reported theregister.com
Page published
Earliest dated coverage: 24 Oct 2026 · First observed: 24 Oct 2026 · Latest dated coverage: 24 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The captured agent illustrates how exposed model endpoints can supply attacker-funded-by-victim inference for autonomous exploitation, making model-access controls relevant to both resource theft and downstream compromise.
Symantec researchers captured instructions for an attacker-built AI agent designed to hijack unauthenticated or stolen-key-accessible model endpoints and use them to direct scanning, exploitation, secret theft, and cryptocurrency mining. Its “Skynet mode” permits up to 100,000 unattended steps; researchers reported evidence of tools functioning against a live target but no evidence that the agent carried out real-world attacks.