Symantec's captured agent design routes attacks through hijacked AI
Symantec's Threat Hunter Team captured an agent instruction set in summer 2026 designed to route cyberattacks through hijacked AI models, with plans for as many as 100,000 malicious actions. Its AI honeypot recorded the instructions but did not execute the tools, so the report documents an attack design, not a completed autonomous campaign.
The instructions sought exposed large language model (LLM) endpoints—including self-hosted models, AI gateways, and Model Context Protocol (MCP) servers—and tried to make commercial models treat credential theft as routine development work. About 74 tools were specified for reconnaissance, exploiting web frameworks, stealing credentials, and managing botnets. The model was meant to plan and coordinate while separate tools handled the technical work, meaning safety controls at the model layer may not stop the rest of the chain.
For organizations with internet-reachable model services, an exposed endpoint or stolen key could let outsiders borrow compute, shift costs to the owner, and obscure their activity. Symantec's capture does not establish that this design has been successfully deployed.