Symantec captured an attack agent's full instructions: 74 tools and up to 100,000 unattended steps, paid for by whoever left a model endpoint open

Symantec says it captured the agent's working prompt in summer 2026 using an AI honeypot, a system that imitates an unprotected, internet-facing AI service. The prompt was sent as if to a real model. It defines one agent with 74 offensive tool definitions, among them internet-wide asset discovery, exploit modules for frameworks such as Django, Jupyter, Next.js and Supabase, credential harvesting and cryptocurrency mining. A directive the operators called "Skynet" mode authorizes up to 100,000 steps without human approval and tells the model to run tools without asking permission. Layered jailbreak text, which Symantec quotes, tries to make a commercial model treat reading .env files and API keys as routine development work.

The agent is meant to run on someone else's model. Symantec lists the targets it expects: self-hosted model servers left open by default, gateways and relays in front of paid model accounts, hastily deployed internal test systems, and MCP servers, all reachable by one scanner because most expose an OpenAI-compatible interface. Its honeypot logged more than 127,000 external requests from tens of thousands of addresses, which it says were dominated by endpoint reconnaissance, stolen-key spraying and probes for exposed configuration files.

The evidence has limits. The honeypot ran none of the tools. The only tool history in the captured request was three scans of a training-platform target that found nothing, and a request the next day carried an obfuscated script designed to install a Monero miner. Symantec researcher Priti More told The Register the techniques are off-the-shelf and that there is no evidence yet that the agent went on to break into other servers.

Why it matters: Symantec's summary of the cost is blunt: "The model's owner pays for every step." If you expose an OpenAI-compatible server, gateway or MCP server for your own agents, including a test box, it falls inside what this scanner is described as looking for, and the endpoint without authentication is the weak point Symantec names. This is a captured instruction set and a documented intent, not an observed campaign.