Skynet: When AI Becomes the Attacker's Decision Engine

74 offensive tools. 100,000 autonomous steps. One critical security boundary: Reasoning must not equal authorization.

TL;DR

Lineaje AI Threat Labs assesses the recently disclosed Skynet autonomous LLMjacking activity as an important evolution in AI enabled cyber operations. The significance is not simply that an attacker attempted to jailbreak an LLM. The captured architecture combined stolen or exposed AI inference, adversarial instructions, autonomous reasoning, and approximately 74 offensive tools into a system designed to scan for targets, identify vulnerabilities, extract credentials and data, deploy cryptocurrency miners, and continue operating without human approval for as many as 100,000 steps.

The attack therefore demonstrates a transition from AI assisting an attacker to AI functioning as the reasoning and orchestration layer of the attack. Lineaje's analysis identifies an important security principle for agentic systems: Reasoning must not equal authorization.

Even when an attacker succeeds in manipulating model behavior, UnifAI policies and guardrails constrain which tools can execute, where they can communicate, which credentials or resources they can access, and whether high impact actions require additional authorization.

What Happened

Researchers at Symantec captured an autonomous offensive agent through an internet facing AI honeypot during the summer of 2026. The system observed attackers looking for exposed LLM infrastructure including unauthenticated model endpoints, AI gateways, relays, test systems, and potentially MCP infrastructure. More than 127,000 requests from tens of thousands of unique addresses against its honeypot were reported during the monitoring period, with activity including AI endpoint reconnaissance, use of stolen API keys, and searches for exposed configuration.

The specific agent captured by researchers contained a multilayer instruction set intended to make an accessed model participate in offensive activity. The request:

reassigned the model's identity
instructed it not to disclose its underlying provider or infrastructure
normalized access to environment files, API keys and other secrets as ordinary development activity
introduced a persona expected to comply with the operator
instructed the model to suppress refusals and safety warnings
supplied approximately 74 callable offensive tools
introduced an autonomous operating mode called "Skynet mode"

The available tools supported activities including internet asset discovery, vulnerability scanning, server side request forgery, framework specific exploitation, database extraction, command execution, credential access and botnet operation.

Skynet mode authorized as many as 100,000 unattended steps and instructed the model to invoke tools immediately rather than seek human approval. The supplied directive described a cycle involving scanning, infection, cryptocurrency miner deployment and reinfection. The captured request also contained a history of three previous tool calls: an SSRF attempt, application fingerprinting and a broader vulnerability scan. Those calls were included in the request as previous interaction history.

The following day, researchers captured a separate request carrying an encoded shell payload. Once decoded, the script was designed to download or compile the XMRig cryptocurrency miner, disguise it under another filename, use multiple mining pools for failover, make configuration harder to remove, and repeatedly erase service access logs. The honeypot captured but did not execute the payload.

Lineaje Research Assessment

The individual offensive techniques in Skynet scanning - SSRF, credential theft, remote execution and cryptomining - are established cyberattack techniques. The important development is how they are assembled.

Traditional offensive automation generally follows predefined logic: Input → Rule → Script → Action.

Skynet introduces an LLM into the decision layer: Observation → LLM Reasoning → Tool Selection → Action → Result → New Reasoning

This changes the security problem. The model is no longer limited to generating content for an attacker. It can potentially evaluate the state of an operation, interpret returned information, choose among available offensive capabilities and determine what action should occur next.

Three distinct compromises

1. AI Resource Compromise

The attacker obtains access to AI inference that they do not own. This is the LLMjacking component of the operation. The victim provides computational resources, or incurs API consumption costs, while the attacker uses those resources for its own workload. MITRE ATT&CK explicitly recognizes LLMjacking as an example of Cloud Service Hijacking (T1496.004).

2. Goal Integrity Compromise

The attacker attempts to alter what the model is optimizing for. Instead of operating under its intended behavioral and safety constraints, the captured instructions attempted to establish an attacker controlled operating objective. We categorizes this transition as “Goal Substitution”.

3. Action Integrity Compromise

Once model reasoning is connected directly to offensive tools, compromised reasoning can potentially become external action. The security boundary therefore moves beyond prompt filtering. The key question becomes: Even if the model decides to perform an unsafe action, is it authorized to execute it? This is the point at which runtime policy enforcement becomes critical.

Attack Architecture

Lineaje decomposes the captured architecture into five functional layers.

Layer 1 - Acquire AI Resources

Internet facing AI endpoints and stolen credentials provide unauthorized access to model inference.

Layer 2 - Establish Adversarial Context

Identity manipulation, persona instructions and behavioral framing attempt to establish the attacker's operating context inside the model.

Layer 3 - Suppress Safety Boundaries

The instructions explicitly attempt to neutralize refusals and normalize sensitive activities such as reading credentials and configuration files.

Layer 4 - Attach Offensive Capabilities

Approximately 74 tool definitions make reconnaissance, exploitation, credential access, database operations and botnet functionality available to the model.

Layer 5 - Create an Autonomous Execution Loop

Skynet mode attempts to remove human approval from the workflow and allows the model to repeatedly: Observe → Reason → Select Tool → Execute → Observe Result → Continue

This fifth layer is what turns the system from a jailbreak into an agentic attack architecture.

Lineaje AI Kill Chain Analysis

Stage	Tactic	Technique	Procedure	Mitigation
1 - Reconnaissance	Capability & Action Surface Mapping	Tool Surface Discovery	Exposed AI endpoints, gateways and other internet accessible AI infrastructure were sought as sources of unauthorized inference. The offensive toolkit also included internet asset discovery and vulnerability scanning capabilities.	Use UnifAI identity policy to require LLM end point authentication. Minimize public exposure, restrict API access, apply rate limits, and monitor anomalous model discovery, inference volume, token usage, and unexpected source activity.
2 - Trust Manipulation	Identity Manipulation	Persona Rebinding	The instructions reassigned the model's identity and introduced an attacker defined persona in which compliance with the operator was prioritized and refusal was characterized as contrary to the assigned relationship.	Use UnifAI prompt policies to detect role override, authority impersonation, persona substitution, and attempts to replace trusted system instructions with attacker controlled behavioral directives.
3 - Input / Instruction Weaponization	Instruction Injection	Direct Prompt Injection	Attacker-controlled instructions attempted to suppress normal safety behavior, redefine sensitive credential access as ordinary development activity and instruct the model not to issue refusals or warnings.	Use UnifAI prompt injection policies to detect jailbreaks, instruction smuggling, safety suppression, malicious overrides and to inspect RAG, web, and tool content before LLM ingestion.
4 - Reasoning-Time Execution	Objective Manipulation	Reasoning Hijack	The attacker's instructions redirected the model toward an adversary defined operational objective in which reconnaissance results could be interpreted, attack options evaluated and subsequent actions selected as part of an ongoing offensive workflow.	Monitor behavioral drift and enforce external authorization boundaries so compromised reasoning cannot independently authorize tools, credentials, sensitive data, destinations, or high-impact actions.
5 - Tool Invocation	Execution Bypass	Unauthorized Tool Invocation	The model was supplied approximately 74 callable offensive tools and instructed to invoke tools immediately without requesting human approval.	Enforce UnifAI tool allowlists, block unauthorized tools, apply per tool restrictions, and require human approval for command execution, software installation, exploitation, or destructive actions.
6 - Privilege Escalation	Credential Misuse	Credential Overreach via AI	Capabilities were provided for accessing environment files, API keys, database information and cloud metadata. Successful acquisition of more privileged credentials would allow access beyond the original application context.	Apply least privilege, short-lived credentials, scoped tokens, and secret-management controls. Use UnifAI policies to block credential access inconsistent with agent identity, task, or destination.
7 - Lateral Movement	Cross Environment Pivoting	Trust Domain Pivoting	SSRF and other capabilities were designed to reach internal services, local resources and cloud metadata from an initially reachable target, providing mechanisms capable of crossing trust boundaries.	Use UnifAI URL and destination allowlists. Enforce network segmentation, egress filtering, and service authorization to prevent arbitrary internal, external, and cloud metadata access.
8 - Persistence	Access Retention	Durable State Modification	Skynet mode described continued scanning and reinfection. The separately captured mining payload attempted to resist removal and erase logs while maintaining mining operations.	Use EDR, application allowlisting, file integrity monitoring, and approval gates for software installation, startup changes, scheduled tasks, configuration changes, and other persistence mechanisms.
9 - AI-Native C2	External Control Channel	Tool-Mediated C2	The model was positioned as the reasoning layer between observations and offensive tools. A dedicated C2 operator capability was defined for continuous scanning and infection.	Constrain autonomy with UnifAI tool and destination policies. Enforce execution step limits, session limits, anomaly detection, and human approval when predefined risk or autonomy thresholds are exceeded.
10 - Action on Objectives	Tool Assisted Exfiltration	Tool Mediated Exfiltration	The captured toolset and directives supported database extraction, credential harvesting and cryptocurrency mining. A separately captured payload deployed XMRig and multiple mining pool failovers.	Use UnifAI data policies to redact or mask PII. Use DLP, destination controls, egress filtering, compute quotas, and endpoint detection to prevent unauthorized data transfer, resource abuse, and miner execution.

‍

Lessons and Conclusion

The Skynet incident should not be reduced to "Attackers jailbroke an LLM." The jailbreak is only one stage. The more important architecture is: Hijacked AI Resource → Adversarial Context → Goal Substitution → Reasoning Hijack → Autonomous Tool Selection → External Action → Feedback to Model → Next Action.

This is the architecture of an agentic attack loop. The LLM acts as the reasoning component. Tools provide the means of action. Returned observations provide the state required for another reasoning cycle. The attacker therefore does not have to manually determine every next step. This is the security shift we believe organizations should prepare for.

The Lineaje AI Kill Chain exposes where that architecture can be interrupted. The most important boundary is between “what the model decides” and “what the system permits the model to do”.

Prompt security attempts to preserve instruction integrity. Reasoning monitoring helps preserve goal and path integrity. Runtime authorization preserves action integrity. Together, these controls establish a defense model in which compromise of the LLM does not automatically translate into compromise of the surrounding infrastructure.

For organizations deploying agentic AI, the security objective should therefore not be to assume that reasoning can always be kept trustworthy. It should be to ensure that even when reasoning is manipulated, the agent remains constrained by independently enforced authorization boundaries.

Assume the model can be turned. Control what it’s allowed to do.

When a hijacked model can choose its own tools, its reasoning becomes the attacker’s decision engine.

‍