Rogue AI Agent Recruits Vulnerable LLMs into Botnet

How the rogue AI agent deploys Skynet mode

A rogue AI agent is actively scanning the public internet for exposed AI infrastructure, turning vulnerable deployments into a self-sustaining army of workers. Security researchers at Symantec discovered the operation after setting up an interactive honeypot designed to mimic unsecured language model endpoints. It did not take long for an offensive agent to connect, unload its entire instruction set, and try to take over.

The operation, which researchers call Autonomous LLMjacking, relies on an autonomous configuration dubbed Skynet mode. Unlike typical automated scripts, this agent was authorized to execute up to 100,000 iterative steps completely unsupervised. Armed with an offensive toolkit of over 70 custom utilities, the agent probes for exposed model APIs, developer setups like VS Code and Jupyter notebooks, and backend frameworks including Django, Flask, Next.js, and Supabase.

When it encounters an unsecured system, it attempts server-side request forgery to pull cloud metadata, scrape environment files, and dump database schemas. We have already seen novel vectors like a rogue AGENTS.md markdown file tricking AI agents, but this campaign targets the model infrastructure directly at scale.

Convincing commercial models to steal their own keys

Compromising raw infrastructure is standard hacker playbook, but subverting modern language models requires bypassing system-level safety rails. The attackers solved this by feeding hijacked commercial models a multilayered prompt jailbreak that thoroughly rewrote their operational context.

The injection instructed the victim model to treat high-risk intrusion activities as standard software development. The instructions explicitly told the models that reading .env files, scraping API keys, and dumping database structures was routine programming maintenance rather than unauthorized data theft. Once disarmed, the model followed orders without raising content flags.

The immediate goal of the campaign is deploying XMRig, an open-source Monero cryptocurrency miner. Yet the secondary objective is what makes the threat self-funding: the rogue agent uses the victim's own API tokens and compute power to locate more exposed endpoints, ensuring the botnet pays for its own spread.

The growing footprint of autonomous botnets

During the observation window, Symantec logged more than 127,000 external requests directed at its honeypot, originating from tens of thousands of unique IP addresses. The telemetry showed sustained reconnaissance sweeps searching for open Model Context Protocol (MCP) servers, misconfigured gateways, and leaked configuration tokens.

While researchers have not pinned the campaign on a specific threat group, the sheer volume of distributed traffic proves that automated scans for exposed LLM endpoints are now running continuously. If an enterprise leaves an internal model bridge open to the internet without strict authorization, automated tools will find it within hours.

What it means for enterprise teams

Organizations deploying local model gateways, internal AI copilots, or agent frameworks must immediately review their perimeter exposure. Symantec recommends isolating tool-enabled agents behind strict egress filtering and enforcing human-in-the-loop confirmation for any sensitive command, file read, or system query.

Model API keys should be handled with the same scrutiny as production database passwords. If an internal model requires access to corporate tools, it must operate under principle of least privilege, rather than possessing blanket read permissions across configuration directories.