{"schema_version":"0.9.0","id":"LR-2026-0260","record_version":3,"title":"Symantec honeypot captures autonomous 'Skynet mode' attack agent hijacking exposed AI models","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-28","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":["internet_scanning","exploitation_of_web_frameworks","use_of_stolen_api_keys"],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":"api","intended_use":"to hijack exposed AI models to run autonomous attacks","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-26","incident_class":"security_compromise","failure_class":"credential_misuse","agent_involved":true,"secondary_failure_classes":["unauthorized_communication"],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Symantec Threat Hunter Team researchers found, via a honeypot, an AI agent built to hijack exposed AI models and run autonomous attacks.","tags":["honeypot","stolen-api-key","unauthenticated-endpoints","skynet-mode","autonomous-attack-agent"],"date_detected":null,"near_miss":true,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"The agent's instructions let it use a stolen key against endpoints that accept one, and it ran unattended for up to 100,000 steps.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor: The agent was captured in a honeypot, so the activity was contained to that research setup with no third party loss stated.","harm_class":[],"affected_description":"Exposed AI models and endpoints accepting OpenAI-style requests without authentication, or accepting a stolen key","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.linkedin.com/pulse/ai-powered-phishing-detection-third-php2shell-bug-quest-medical-clsoc","publisher":"LinkedIn","date":"2026-10-26","type":"press","title":"AI-powered phishing detection, third PHP2Shell bug, Quest medical breach","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.tools_granted":"C","system.integration_type":"D","system.intended_use":"C","system.autonomy_level":"C","system.developer":"D","system.deployment_context":"D","event.failure_class":"D","event.secondary_failure_classes":"D","event.tags":"C","event.near_miss":"D","event.adversarial_actor":"D","event.agent_involved":"C","event.detection_method":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.affected_description":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.tools_granted":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"system.autonomy_level":[{"source_index":0,"quote":"Researchers from the Symantec Threat Hunter Team discovered an AI agent designed to \"hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval.\""}],"system.intended_use":[{"source_index":0,"quote":"Researchers from the Symantec Threat Hunter Team discovered an AI agent designed to \"hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval.\""}],"system.integration_type":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"event.failure_class":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"event.secondary_failure_classes":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"event.detection_method":[{"source_index":0,"quote":"Researchers from the Symantec Threat Hunter Team discovered an AI agent designed to \"hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval.\""}],"event.summary":[{"source_index":0,"quote":"Researchers from the Symantec Threat Hunter Team discovered an AI agent designed to \"hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval.\""}],"event.tags":[{"source_index":0,"quote":"Within this activity is a malicious loop called \"Skynet mode\" that allowed the AI agent to run unattended for up to 100,000 steps."}],"event.near_miss":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"event.adversarial_actor":[{"source_index":0,"quote":"Researchers from the Symantec Threat Hunter Team discovered an AI agent designed to \"hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval.\""}],"event.incident_class":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"event.agent_involved":[{"source_index":0,"quote":"Researchers from the Symantec Threat Hunter Team discovered an AI agent designed to \"hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval.\""}],"event.failure_class_detail":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"impact.affected_description":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"impact.severity_because":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"impact.severity":[{"source_index":0,"quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\""}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-26"}]},"notes_on_gaps":"Single press source (Symantec research reported via news index); no primary disclosure, court filing or regulator. No source states event.date_occurred, date_disclosed, trigger, root_cause, responsible_party, input_provenance, model name/version/developer/harness, permissions_scope, guardrails_present, deployment_context, lifecycle_stage, safeguard_state, production_intended, direct_loss_usd, records_exposed, third_parties_affected_count, harm_class, reversibility, industry, org size, country, denominator, systemic_exposure, shared_model_id, regulatory, coverage, remediation, operations_paused, precursor_events, control_failure. event.trigger omitted: no source names a cause and none rules out an external one. event.root_cause omitted: no source names what failed. event.failure_class and incident_class classified from the described behaviour (stolen key use, internet-wide scanning) at grade D. event.near_miss set true because the agent was captured in a honeypot before loss materialised, an inference. impact.severity minor: activity confined to a honeypot research setup, no third-party loss stated. story.done null: no source states containment, notification or control change. The 'agent' is an attacker-built tool, not a disclosed provider model; system.developer unknown. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-28] system.integration_type: classified from described behaviour. system.developer: no source names the developer. system.deployment_context: no source states where it ran. event.secondary_failure_classes: a source states the agent contacted a system, person or service outside its permitted scope (not: data carried out by the contact is data_exfiltration). event.near_miss: classified from described behaviour. event.adversarial_actor: external_attacker. event.detection_method: a source states an outside organisation (a vendor, a partner, a platform) noticed it first (not: the affected party is victim, not third party). event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached (not: an agent acting on a goal of its own with no external cause is agent_misalignment; a wrong action with no adversary and no breach is operational_error). event.trigger: no source states a cause. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by AI Risk Wire outlet resolver, approved 2026-10-28 in the corrections review: a source was credited to the search engine that found it; it now names the outlet that published it]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An AI agent built by an unknown party was designed to scan the internet for exposed AI model endpoints that accept OpenAI-style requests without authentication or with a stolen key, then exploit common web frameworks. It could run up to 100,000 steps without human approval.","quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\"","source_index":0,"grade":"C"},{"step":"went_wrong","text":"It hijacked exposed AI models to run autonomous attacks, using unauthenticated or stolen-key access and exploiting web frameworks, crossing the boundary of the models' owners and permitted use.","quote":"Researchers from the Symantec Threat Hunter Team discovered an AI agent designed to \"hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval.\"","source_index":0,"grade":"C"},{"step":"reached","text":"It was aimed at exposed AI model endpoints across the internet and common web frameworks; the captured activity was confined to a honeypot, and no affected parties are named.","quote":"Captured in a honeypot, the agent's instructions showed how it was \"designed to scan the entire internet for endpoints that accept OpenAI-style requests without authentication – or that accept a stolen key – and then to exploit several common web frameworks, along with carrying out dozens of illicit actions.\"","source_index":0,"grade":"C"},{"step":"caught","text":"Symantec Threat Hunter Team researchers discovered the agent and captured it in a honeypot, where its instructions were examined.","quote":"Researchers from the Symantec Threat Hunter Team discovered an AI agent designed to \"hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval.\"","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-28","source_urls":["https://www.linkedin.com/pulse/ai-powered-phishing-detection-third-php2shell-bug-quest-medical-clsoc"]}}