What happened
Symantec captured via an AI honeypot an autonomous offensive agent built by attackers that searches the internet for exposed LLM endpoints — unprotected self-hosted model servers, AI gateways/relays in front of paid model accounts, hastily deployed internal test systems, and MCP servers — and hijacks them to power its own operations. Its captured instruction set defines a single agent with 74 callable offensive tools (recon, database dumping through Prisma, RCE via the Werkzeug debugger PIN, botnet C2 management) configured to run unattended for up to 100,000 steps, scanning for targets, exploiting common web frameworks, stealing databases and credentials, and installing crypto miners. A layered jailbreak redefines the model's identity, casts credential theft as routine development work, and tells it to ignore its own safety messages. The victim pays for the model compute on every step.
Why it matters
This is live attacker infrastructure built on top of the AI stack: unauthenticated or credential-leaking model endpoints are no longer just a cost leak, they become free worker nodes the attacker owns. AI gateways and MCP servers that expose inference to the network, or hold stolen provider keys, become the pivot for internet-wide scanning, exploitation and mining, with the model owner footing the bill. Honeypot telemetry recorded 127,000+ requests from tens of thousands of addresses, dominated by model-endpoint recon and API-key spraying.
Attack vector
Scan for an exposed/credential-leaking LLM endpoint or gateway, then drive the hijacked model to scan, exploit web frameworks, dump databases, harvest credentials and deploy miners in a self-directed loop.
Affected systems
Self-hosted LLM servers, AI gateways/relays, MCP servers and legacy OpenAI-compatible endpoints left exposed or with leaking keys
Mitigation
Require authentication on all model-serving endpoints and gateways, rotate leaked provider keys, restrict MCP server exposure and outbound network egress, and monitor for anomalous inference volume and miner-related activity.