Attackers built a ‘Skynet’ AI agent that hijacks exposed models to run cyberattacks

Source: CSO Online · OCT 27, 2026

Skynet is no longer a fictional adversary. Attackers have built an offensive agent that exploits unprotected AI models on the web with a ‘Skynet’ directive that allows them to run unattended for up to 100,000 steps. In this mode, a reference to the humanity-destroying artificial neural network-based superintelligence system in the Terminator film franchise, the agent can kick off tools, scan for and infect targets, deploy data miners, steal credentials , reinfect hosts, and mine cryptocurrency, all without waiting for human approval. The activity is a form of LLMjacking, in which attackers essentially commandeer a victim’s AI model for their own purposes. The victims themselves then foot the bill. The method was discovered by the Symantec Threat Hunter Team, who were able to capture it in a honeypot and get a rare look at the anatomy of an attack. “The attackers are not just using AI; they are using your AI,” noted Frank Dickson of Dickson Research. The owners pay for every step, and t