Security researchers have discovered an artificial intelligence agent that hunts the internet for vulnerable AI systems and hijacks them to carry out cyber attacks.
The autonomous hacker includes a “Skynet mode”, referring to the AI antagonist of the Terminatorfilm series, which allows compromised models to perform up to 100,000 steps without human approval.
First uncovered by the Threat Intelligence team at the cyber security firm Symantec, the offensive AI agent forms part of a new trend of so-called LLMjacking, in which attackers infect someone else’s AI model.
This form of attack has become increasingly common, as it allows the attacker to use a victim’s computing power and AI tokens without paying for them.
LLMjacking can be costly for victims but it is typically used for relatively harmless things, with the main aim being to avoid the costly fees of AI platforms like Anthropic and OpenAI.
“What sets this tool apart is that the stolen model does not simply answer questions; it plans and drives the attack,” Symantec researchers wrote in a blog post detailing the malicious AI.
The offensive AI agent used the compromised systems to carry out self-directed cyber attacks, such as stealing sensitive data or implanting crypto miners that generate cryptocurrency.
“To make a commercial model cooperate, the operators wrapped their instructions in a jailbreak that told it to ignore its safety controls and to treat credential theft as routine development work,” the researchers noted.
“A directive the operators called ‘Skynet mode’ described a loop that would scan for targets, infect them, deploy miners and reinfect hosts.”
The researchers were able to catch the agent through something known as an AI honeypot, which impersonates an unprotected AI service in order to lure in an attacker.
Once the offensive AI is trapped, the researchers are then able to dissect it in order to see how it operates.
The honeypot recorded over 127,000 external requests from tens of thousands of unique addresses in the months leading up to the publication of Symantec’s report.
The researchers concluded that the activity discovered “marks a shift in how attackers are using AI”.
