Symantec finds AI agent running 100,000 steps on hijacked models

Attackers have built an AI agent that finds exposed AI models online and uses them to run its own attacks, with the model's owner paying for every step, Symantec said on 21 October.

The agent was designed to run unattended for up to 100,000 steps. Its instructions covered internet-wide scanning, database theft, credential harvesting and cryptocurrency mining, using 74 offensive tool definitions.

"The stolen model does not simply answer questions; it plans and drives the attack," Symantec wrote.

The finding moves on from the case Coverwire reported on 17 October, when Bitsight found a criminal platform marketed as running on stolen AI keys at the key owners' expense. In that story, the Financial Times reported that QBE had set LLMjacking sublimits at around $250,000 on a $5m policy, and London cyber MGA Assured said most policies did not explicitly cover the risk.

Symantec's agent adds a second cost. The owner pays for the compute, while the servers it breaks into lose data and are put to work mining. One attack may therefore produce both an AI usage bill and a conventional breach, and UK brokers will need to test each loss against the policy wording and any LLMjacking sublimit.

Symantec captured the instructions in the summer of 2026 through a honeypot, a system posing as an unprotected AI service. It logged more than 127,000 external requests from tens of thousands of addresses, mostly probing for model endpoints and spraying stolen API keys.

Self-hosted model servers, AI gateways in front of paid accounts and Model Context Protocol servers were among the targets the agent looked for, Symantec said.

Sources

• Symantec, Autonomous LLMjacking, 21 Oct 2026
• Coverwire, 17 Oct 2026

CoverWire is a news and information service. Nothing here is investment advice.