Symantec finds an AI agent made to do 100,000 attack steps alone

The Threat Hunter Team of Symantec found a malicious AI agent with an AI honeypot, which is a fake open AI service that attracts attackers. The team captured the full instructions of the agent in summer 2026 and published its report on 21 October. The agent can do a maximum of 100,000 dangerous steps with no human approval. The honeypot did not operate the tools of the attacker.

How it works

The agent looks for open LLM endpoints, such as self-hosted models, AI gateways and MCP servers. This is called LLMjacking. The agent uses their models or a stolen key. The victim pays the cost, and the attacker gets no account ban.

What was found

The instructions show about 74 tools for scans, attacks on web frameworks, theft of databases and credentials, and botnets. A different message had a script to install Monero mining software and erase logs. The honeypot saw more than 127,000 external requests.

What is not known

Symantec says no method is new. The source does not tell who made the agent or how many victims there are. Symantec says the mix lowers the skill that an attacker must have.

Insight: The victim pays for the attack on itself

Symantec says that the attackers put AI in their own tools, and do not try to trick public chatbots. A related study found a success rate of more than 95% against guardrails with groups of safe queries. This looks like attackers that move the cost and the risk to the endpoints of strangers. This means that each open AI service becomes free for use. Monitor your own AI endpoints and bills.