Attack-agent instructions link hijacked AI planning to unattended attacks

According to The Register, Symantec’s Threat Hunter Team captured the agent’s full instructions in an AI honeypot—a decoy intended to attract and observe malicious activity. The instructions direct it to find AI endpoints that accept OpenAI-style requests without authentication or with a stolen key, then use those models to plan attacks.

The captured material includes 74 offensive tool definitions and layered jailbreak prompts, meaning instructions intended to bypass a model’s safeguards. More said the recorded history showed tools working against a live target with realistic-looking scan output. She nevertheless emphasized that the team had no evidence the agent had progressed to real-world attack deployment.

Symantec threat hunter Priti More described the individual techniques as familiar and the jailbreak layers as largely off-the-shelf. The report does not provide a comparable earlier agent or measurements showing an increase in attack performance.

The newly described combination delegates planning to a hijacked model while the agent’s own modules perform scanning, exploitation and mining against separate targets. The unattended step allowance is part of its instructions, not evidence that a complete run succeeded.

The design separates the model supplying the reasoning from the systems targeted by the attack tools. More described two potential sets of victims: an exposed AI endpoint’s owner would pay for inference, while any successfully compromised server could lose data and be used for mining. Those downstream harms were not established in the reported finding.