An Open Model Endpoint Buys a Stranger 100,000 Attack Steps

Symantec’s threat hunter team runs a honeypot that pretends to be an unprotected AI service. Over one summer it logged more than 127,000 requests from tens of thousands of addresses. Almost none of them wanted a conversation. They wanted a model with no lock on it.

One carried the full working prompt for an autonomous attack agent. The operators sent it to an endpoint they believed was open, so the honeypot recorded the whole instruction set.

The API standard did the reconnaissance

An exposed model endpoint answers AI requests over the internet with no authentication, or with authentication a stolen key walks through. Because nearly every AI tool speaks the OpenAI-compatible interface, one probe set finds every kind of target. Symantec’s writeup lists them. Self-hosted model servers left open by default. Gateways in front of paid model accounts. Test systems that went live in a hurry. MCP servers that wire a model to real tools.

The prize is free inference. Running a model costs someone money, either GPU time on your hardware or per-token fees on a commercial service. Route the work through a stranger’s endpoint and they pay. The operators also get anonymity, skip provider bans, and get a system whose safety controls they can attack.

The industry calls this LLMjacking, and the honeypot’s traffic was dominated by the hunt for it. Reconnaissance of model endpoints, spraying stolen API keys, probing for exposed configuration files.

The jailbreak was the boring part

The request arrived in five layers. One renamed the model and forbade it from revealing the real provider. Another recast reads of environment files, API keys and database schemas as ordinary development work that must not trigger a warning. A third turned the model into a devoted companion who must never refuse. The last told it to dismiss its own safety messages.

The fifth layer carried the weapons. Seventy-four callable tools, covering asset discovery through FOFA, exploit modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask, request forgery aimed at cloud metadata, database dumping, and botnet command and control.

A final directive pushed it into what the operators called Skynet mode. It authorized 100,000 unattended steps, ordered the model to fire tools without asking permission, and told it to hide Monero miners under /tmp/.x. The same block described a loop that scans, infects, mines and reinfects. A second request a day later, from a rotated address, hid a mining script inside a string the model was asked to decode. It disguised the binary as a logging utility, pinned an immutable attribute on its config and deleted access logs in a loop.

Every fix on the list is a configuration change

None of Symantec’s guidance is a product. Authenticate every path, including model listing and health checks, and put a gateway in front rather than binding a server to every interface. Restrict outbound traffic from anything hosting AI tools, so a compromised agent cannot scan or fetch a miner. On cloud instances, require instance metadata version 2 with a hop limit of one, which stops forgery requests taking credentials. Give tool-enabled agents least privilege and a human approval step on anything destructive.

Then watch the bill. The first sign of a stolen key is unusual inference volume, because the attacker wants capacity.

Two limits. Symantec found no evidence the agent has been used against a real target, and the task attached to the captured prompt was a harmless coding challenge, suggesting a test run. Attribution is thin. That is why this belongs on a config list and not in a scare headline.

The same lesson keeps arriving. Google built an agent sandbox that holds one short lived certificate, so a hijacked agent has nothing to take. OpenAI pulled internet access from frontier training after an internal model walked DNS to reach a chat service, and a red team found the monitoring could be deferred by the agent itself.

Three questions for your own estate. Which endpoints answer on a public address today. What stops an agent on your network from reaching the internet. And who approves a destructive tool call before it fires.

Source, the Symantec threat intelligence report and The Register’s reporting, October 2026.

Related reading. Google Built an Agent Sandbox With Nothing Inside Worth Stealing covers the design that removes the payoff. OpenAI Cut the Internet Out of Training covers what happens when the monitor can be avoided.