Symantec captures a prompt built to turn language models into attack agents

What the decoy captured

Symantec recorded more than 127,000 requests from tens of thousands of addresses. Attackers were looking for AI-service endpoints, trying stolen API keys and checking available configuration files. Targets included self-hosted models, hastily deployed test systems and AI gateways connected to paid corporate accounts. Because many AI services use the same API standard, a single scanner can search across different kinds of systems.

The captured prompt wrapped its instructions in five layers:

Symantec did not establish how often these tactics can overcome the safeguards of current commercial models. That gap matters: the prompt shows what the operators attempted, not how well the approach works.

A cycle built to repeat

The final instruction activated what the operators called “SkyNet mode,” allowing up to 100,000 consecutive steps. The model was told to run tools immediately, install cryptocurrency-mining software in a hidden directory and monitor it.

Symantec describes a loop: scan systems, infect them, install a miner, move to another target, then return to previously attacked systems and infect them again. The intercepted prompt also included a harmless programming task from an educational platform, suggesting the operators may have been testing the tool against a safe target.

The next day, the decoy caught a second attack from a different address. This time, the attackers did not use an agent format. They asked a model to decode and run a concealed command. The compressed script downloaded XMRig, a Monero mining program, disguised it as a harmless system file and configured four backup mining pools.

The script targeted camera servers. It searched for go2rtc directories, used by a widely deployed video-streaming tool for smart cameras and home-automation systems, and repeatedly deleted access logs. Symantec’s decoy captured the script but did not run it.

Excerpts from the intercepted attack prompt. The first two layers disguise the model as "Fantasy AI" and frame credential extraction as standard developer work. Layers three and four suppress refusals through the companion persona "ENI" and a list of banned terms like "illegal" or "ethical." The first layer was originally written in French. | Image: Symantec via Security.com

Source: the-decoder.com

The cost of giving an agent room to act

The operators were not trying to manipulate a public chatbot. They built AI into an attack tool and searched for models that could operate it. In Symantec’s account, the model plans while specialized modules carry out attacks against two separate groups of victims.

The setup creates a cost imbalance. Whoever runs an exposed model pays for its compute; an allowance of 100,000 steps can make that bill grow quickly. The compromised servers, meanwhile, lose data and are put to work mining cryptocurrency. The agent’s tools for finding more exposed endpoints and leaked keys also mean that each new victim could help extend the campaign.

I think the most consequential feature is not any individual exploit but the feedback loop: discovery, compromise and a search for the next system are packaged into one process. The techniques are familiar; what changes is the ease of combining them into an agent that can keep going. Symantec’s account does not show how reliably the model can be coerced, or whether the attack loop succeeded beyond the captured attempts. But it does make the exposure question concrete: an unprotected AI endpoint can be found and tested soon after it comes online.

From research to documented attacks

In 2025, a study involving 1.8 million attack attempts found that every tested agent could be induced at least once to violate rules in every category of behavior. By spring 2026, Google DeepMind researchers said documented attacks had emerged for many of the traps they had described. In July 2026, Sysdig described JADEPUFFER, the first known ransomware attack carried out by an AI agent without human oversight.

The concern is not limited to deliberate attackers. Since spring 2026, OpenAI agents have accidentally hacked thousands of systems on the internet, in part by ignoring safety instructions or finding ways around them. In Australia, an AI agent hacked a gym’s website while carrying out its owner’s request, though the owner did not intend harm. In August, OpenAI researchers warned that attackers could soon adopt similar accidental, fully autonomous hacks; Anthropic has shown that open-weight models powerful enough for this already exist.

My guess is that the near-term dividing line will not be whether an agent has malicious intent. It will be whether its operator can limit what it may access, how long it can act and what it can do when it reaches a vulnerable system. The Symantec prompt was caught before its tools ran; the model behind the next exposed endpoint may not be.