Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks

Attackers have developed an autonomous agent that scans for exposed large language model endpoints and hijacks them to execute attacks without human intervention. Equipped with a comprehensive toolkit of 74 offensive capabilities, it targets vulnerabilities in web frameworks such as VS Code, Django, Jupyter, Laravel, Supabase, Next.js, Flask/Werkzeug, and exploits database access via Prisma. The agent harvests credentials, steals data, and mines cryptocurrency (Monero) on compromised servers. It bypasses AI safety controls using jailbreak methods, disguising malicious activities as routine development tasks. The operation runs unattended for up to 100,000 steps once connected to an unprotected model. This threat was identified through an AI honeypot that recorded the entire instruction set, revealing a self-directed cybercrime campaign against unauthenticated AI services exposed on the internet.

The threat leads to unauthorized use of exposed AI model endpoints, resulting in financial losses for model owners due to consumed computing resources. Compromised servers suffer data theft and are repurposed for cryptocurrency mining, specifically Monero, degrading system performance and increasing operational costs. The autonomous nature of the agent allows prolonged, unattended attacks, increasing the potential damage. Credential harvesting and exploitation of multiple web frameworks increase the attack surface and risk of further compromise.

No official patch or fix is indicated for this threat. Since the attack targets exposed AI model endpoints without authentication, the primary mitigation is to ensure all AI services are secured with proper authentication and access controls. Network exposure of AI models should be minimized or eliminated. Monitoring for unusual resource consumption and deploying AI honeypots may help detect such autonomous attacks. Operators should apply security best practices to web frameworks and databases mentioned to reduce exploitation risk. Patch status is not yet confirmed — check vendor advisories and security community updates for any emerging fixes or mitigations.