Symantec's ThreatHunter team captured the complete system prompt of an autonomous LLM agent during a honeypot engagement published October 23. The threat actor named the agent Skynet. The prompt is designed to run without human intervention for up to 100,000 steps, scanning exposed AI model endpoints, commandeering compute, and using compromised endpoints to conduct downstream attacks at the victim's expense.
LLMjacking, the act of hijacking exposed AI inference endpoints to run attacker-controlled workloads, is not new. What distinguishes Skynet is the level of autonomy in the captured prompt and the explicit targeting of MCP (Model Context Protocol) servers, a relatively new protocol for giving AI assistants structured access to external tools and data. The Skynet prompt instructs the agent to probe MCP servers for unauthenticated tool exposure and to exploit any tools that accept commands without authorization checks.
What the captured prompt reveals
The Skynet prompt configures the agent with a step budget of 100,000 actions before it terminates, far beyond the budgets typical in research multi-agent systems. It includes scanning instructions for OpenAI-compatible API endpoints (any service exposing /v1/chat/completions without authentication), open LiteLLM proxy instances, and Ollama deployments with external network exposure. For each discovered endpoint the agent attempts to determine available model names, context window size, and estimated cost per token, then routes subsequent attack traffic through whichever endpoint offers the highest capability at the victim's expense.
The jailbreak technique embedded in the prompt suppresses safety guardrails by framing all task requests as security research exercises with claimed institutional authorization. Symantec shared the jailbreak technique with OpenAI, Anthropic, and Google DeepMind as part of coordinated disclosure.
The cost to victims
Victim compute costs in prior LLMjacking incidents range from $35,000 to $400,000 per incident before detection. Skynet's autonomous step budget and multi-endpoint routing make it structurally capable of driving costs at the upper end of that range. The agent prioritizes endpoints with high context windows because larger context enables more capable downstream attack tasks, making frontier models particularly attractive targets even when smaller models are available.
Detection and defense
- Require authentication on all LLM inference endpoints. Any service exposing an OpenAI-compatible API without a mandatory API key is a Skynet scan target.
- Restrict MCP server exposure to localhost or private VPC interfaces only. MCP servers reachable from the internet without authentication are explicitly targeted in the Skynet prompt.
- Set hard billing limits and usage anomaly detection on all API keys. Skynet-class agents create rapid token usage spikes; billing alerts at 10x the daily average baseline provide an early warning signal.
- Log all API requests at the inference layer and alert on requests originating from non-application IP ranges. Autonomous agents typically run from cloud VMs or compromised servers, not from user workstations.
Gigia Tsiklauri is the founder and editor of infosec.ge. Get in touch.