Symantec: AI agent designed for 100,000 malicious actions without human intervention
Researchers behind Symantec's Threat Hunter Team have documented a complete instruction set for a fully autonomous malicious AI agent, captured in an AI honeypot in the summer of 2026. The agent was designed to use hijacked language models as its reasoning engine and to carry out up to 100,000 malicious actions without human approval. The findings were described in a report published on October 21, 2026, and all reporting on the paper reaches us via Infosecurity Magazine's coverage.
How the agent was discovered
The honeypot is a system that pretends to be an unprotected, internet-exposed AI service, set up precisely to attract and study attacks against AI infrastructure. From its deployment until the report's publication, the honeypot logged over 127,000 external requests from tens of thousands of unique addresses. This is not an isolated incident, but a steady stream of activity against exposed AI endpoints.
In that traffic, the researchers captured a complete instruction set for an autonomous attack agent. Notably, the honeypot never ran the attacker's tools. The instruction set was captured, not executed. What has been documented, then, is how the agent was designed to work — not a proven, completed attack against real victims.
How the agent is built
The captured instruction set contains roughly 74 tools covering the entire attack chain: internet-wide reconnaissance, exploitation of common web frameworks, database theft, credential harvesting, and botnet management. According to Infosecurity Magazine's account of the report, the agent was designed to use hijacked AI models to autonomously carry out up to 100,000 malicious actions — scanning for targets, exploiting vulnerabilities, stealing credentials, deploying cryptocurrency-mining code, and reinfecting compromised systems.
The instructions also included layered guidance for overriding the safety controls of commercial models. The reporting does not specify which commercial models these bypasses targeted. In addition, the researchers found an obfuscated Monero-mining script — code made deliberately hard to read, pointing to a plan to also monetize the agent through cryptomining on hijacked machines.
Why hijack other people's models?
The entry point itself is what Symantec researchers call "LLMjacking": the agent searches for exposed endpoints tied to large language models, including self-hosted models, AI gateways, and MCP servers (model context protocol), in order to use their computing power without paying for it.
The benefit to an attacker is threefold, according to the finding. First, free compute: AI-driven attacks require many model calls, and running them on someone else's GPUs costs nothing. Second, anonymity: the traffic and load land on the owner of the exposed endpoint, not the attacker. Third, avoidance of vendor bans: attackers using their own accounts with commercial AI providers risk having those accounts shut down when abuse is detected. Hijacked, self-hosted endpoints have no such safeguard.
Symantec's assessment: the combination is the news
The most interesting aspect of the finding, according to the researchers, is not any single component. None of the techniques — scanning, exploitation, credential theft, mining, botnet management, or the use of hijacked models — was new on its own. What is new is that they are packaged into a single autonomous agent in which the language model serves as the reasoning engine.
"It marks a shift in how attackers are using AI," the Symantec researchers concluded, according to Infosecurity Magazine. The shift is from trying to trick public chatbots into misbehaving, to building AI directly into offensive tooling. That has a practical consequence: the skill requirement for running large exploitation campaigns drops. Where such campaigns previously required manual operators with broad expertise, a ready-made agent with roughly 74 tools can in principle do the job itself, with a design capacity of up to 100,000 actions.
What is documented — and what remains uncertain?
It is important here to separate the factual from the possible. Documented, via Infosecurity Magazine's coverage of Symantec's report: that the instruction set existed, what it contained, the honeypot's traffic volume, and the agent's design capacity of up to 100,000 actions. Not documented: who was behind the agent, where they came from, and whether the agent has actually been used in campaigns against real victims outside the honeypot. The reporting offers no information about the scale of abuse of hijacked endpoints beyond the honeypot traffic itself.
It is also worth noting that coverage of the report so far rests on a single intermediary source. No independent verification of Symantec's findings is available in the material at hand. That does not make the finding less credible — Symantec's Threat Hunter Team is an established research group, and the methodology described is standard for honeypot-based threat analysis — but it means the figures and details should be read as the researchers' own documentation, relayed through trade press, not as independently verified facts.
What this means for owners of AI infrastructure
Regardless of the open questions, the finding points to a concrete exposure surface: self-hosted language models, AI gateways, and MCP servers left open to the internet. The honeypot's more than 127,000 requests from tens of thousands of addresses suggest such endpoints are being actively and continuously scanned. For organizations running their own AI infrastructure, the lesson is twofold: exposed LLM endpoints are not merely a risk of compute theft (LLMjacking), but can in the worst case be used as fuel for autonomous attack tooling — and the safety controls of commercial models are, according to the captured instruction set, something attackers actively attempt to bypass with layered instructions.
Whether the same agent has operated against real targets remains an open question.