Unprotected AI models hijacked for self-sustaining cyberattacks

Organisations running unprotected language models face immediate financial and security risks from an autonomous AI agent. Symantec researchers have identified a technique termed "LLMjacking" where attackers hijack these systems. The agent operates independently, launching sustained cyberattacks that compromise servers and steal sensitive data. This threat exposes any entity with exposed AI endpoints to significant liability.

How does the attack work?

The malicious agent targets unprotected language models available on the internet. Once it gains access, it uses a five-layer jailbreak method to bypass safety rules. It then scans for further targets, exploiting flaws in common server software. The agent steals databases and credentials while installing cryptominers in the background. It continues this cycle autonomously.

What is the financial impact?

The primary burden falls on the owner of the hijacked model. According to Symantec, these owners are stuck with the compute bill for the attacks. The agent can execute up to 100,000 steps without human involvement. This means the victim organisation pays for the processing power used to attack other systems and mine cryptocurrency. The cost accumulates rapidly during the unattended session.

How was this activity detected?

Symantec researchers used a honeypot to capture the attack. The honeypot mimicked an open AI service online. Attackers sent their entire working prompt to this decoy system. This allowed researchers to analyse the agent's architecture in summer 2026. The honeypot did not run any bundled tools, ensuring safe observation. The session ended after a generic system response.

What does the telemetry show?

The honeypot logged more than 127,000 requests. These came from tens of thousands of different addresses. Most requests were searches for AI endpoints. Others involved brute-force attempts with stolen API keys. Probes of exposed configuration files were also common. Targets included self-hosted model servers and test systems. AI gateways protecting paid accounts were also scanned.

What affected people can do

Teams should immediately audit all AI endpoints for unnecessary exposure. Check whether language models are accessible to the public internet. Ensure that API keys are rotated and not hardcoded in configuration files. Monitor compute usage for unusual spikes that might indicate hijacking. Recognise that follow-up scams may claim to fix these issues. Verify any unsolicited offers through official channels before engaging. Do not share sensitive credentials with unknown entities posing as support staff.

What to do and how to stay safe: Symantec

• Restrict access to all language models and AI endpoints to authorised users only.
• Rotate all API keys immediately if you suspect they have been exposed or stolen.
• Monitor compute bills and usage logs for abnormal activity that suggests unauthorised access.
• Ensure configuration files are not publicly accessible on web servers or repositories.

Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is LLMjacking?

LLMjacking is the theft of access to someone else's AI models, allowing attackers to use them for malicious purposes.

How many steps can the agent execute?

The agent can execute up to 100,000 steps without human input, according to Symantec's analysis.

Who pays for the compute costs?

The owner of the hijacked model gets stuck with the compute bill for the attacks launched by the agent.