When attackers borrow your inference endpoint
An unauthenticated model endpoint used to look like a billing problem.
Now it can be an attack primitive.
On October 21, Symantec described an offensive agent it captured in an AI honeypot. The agent was designed to find exposed or stolen-access model endpoints, use the borrowed model as its reasoning engine, and direct a separate toolkit against other systems. Its configuration described up to 100,000 unattended steps, credential theft, vulnerability scanning, and cryptocurrency mining.
The important distinction is that the captured session did not prove a successful campaign against real victims. The honeypot did not execute the tool calls. What it did prove was the design: the model owner pays for the inference while an attacker uses that inference to plan and drive operations elsewhere.
The new liability
An exposed AI endpoint is not only a service that can be abused. It can become the control plane for an attacker who does not own the model, the account, or the compute bill.
The borrowed brain
The captured pattern, which Symantec calls autonomous LLMjacking, is different from asking a public chatbot for malicious instructions. The attacker is not primarily looking for an answer. They are looking for an always-on reasoning component that can select the next action in a long-running operation.
The endpoint can be a self-hosted model server, an internal test deployment, an AI gateway backed by paid provider credentials, or an MCP-connected service. Many expose an OpenAI-compatible request shape, so an attacker does not need a bespoke integration for each target.
That compatibility is useful for developers. It is also useful for scanners.
Why this changes the risk calculation
The obvious impact is resource theft. A stolen provider key creates a usage bill. An exposed self-hosted model consumes GPU time. A compromised gateway can turn normal inference capacity into an attacker-controlled budget.
The less obvious impact is operational. If the borrowed model is used to plan scanning and exploitation, the endpoint owner's infrastructure becomes part of the campaign's reasoning path. Logs, network reputation, abuse investigations, and possibly legal inquiries point toward the organization that supplied the inference.
Three parties can lose in one chain:
The endpoint owner
Pays for inference, absorbs traffic and may become the apparent source of abuse.
The downstream victim
Faces scanning, credential theft, exploitation, or unauthorized mining from a campaign that can iterate quickly.
The security team
Must distinguish ordinary experimentation from an agent using its model as an unattended control loop.
This is why usage monitoring alone is insufficient. A spike in tokens is a useful signal, but it does not explain whether the model is answering a batch job, serving a test, or driving a hostile loop.
The agent is the control plane
Traditional LLMjacking treats the model as a commodity. The attacker wants cheaper access to generation, usually for content production or mining-related automation. The new pattern treats the model as a decision-maker inside a tool-enabled system.
That creates a boundary problem. The model endpoint may have no direct permission to scan the internet or execute a shell command. The surrounding agent may have those permissions. If the endpoint can be reached without strong identity and the agent accepts its output as a next-step instruction, authorization is effectively delegated to whoever can submit a request.
In the language of the OWASP Agentic Top 10 (2026), this crosses several concerns at once:
- ASI02, Tool Misuse and Exploitation: legitimate tools are assembled into an unauthorized workflow.
- ASI03, Identity and Privilege Abuse: a stolen key or anonymous endpoint access is treated as sufficient authority to operate the agent.
- ASI04, Agentic Supply Chain Vulnerabilities: a shared model gateway or MCP service becomes a dependency that can be repurposed across many workflows.
- ASI05, Unexpected Code Execution: the model's decisions reach tools that can write files, execute commands, or alter infrastructure.
- ASI10, Rogue Agents: the system continues operating toward an attacker-supplied objective without meaningful human control.
The categories matter because the fix is not a better refusal prompt. The fix is to separate model access, tool access, identity, and runtime authority.
What the captured activity does and does not show
Security teams should resist two opposite mistakes. Underreacting because the payload was captured in a honeypot is a mistake. Treating the report as proof that every exposed model has already been used in a successful autonomous attack is also a mistake.
The defensible conclusions are narrower and more useful:
- Attackers are actively looking for AI endpoints and credentials.
- An offensive agent can use a borrowed model as its planning layer.
- The captured configuration was designed for long unattended execution.
- The mining and exploitation components are conventional techniques combined into an agentic workflow.
- The specific capture does not establish a victim count or successful downstream compromise.
That evidence standard should shape detection. Look for behavior that is observable regardless of the operator's prompt or model provider.
The controls that matter now
Endpoint and gateway checklist
- Require authentication on every model route, including health, discovery, and model-listing endpoints.
- Keep self-hosted model servers on private interfaces unless public exposure is a documented requirement.
- Inventory AI gateways, MCP servers, local model runtimes, test deployments, and provider keys outside the central platform team.
- Scope keys by environment, model, operation, spend, and network origin. Rotate any credential that appeared in source, logs, or a public artifact.
- Put hard spend and request-rate limits around inference. Alert on unusual token velocity, model switching, and long-running sessions.
- Restrict egress from tool-enabled agents. A compromised reasoning loop should not be able to scan arbitrary networks or download payloads.
- Log the full chain: caller identity, model request, tool decision, tool invocation, target, result, and approval state.
The most valuable control is correlation. A single large request may be normal. A sequence of model calls followed by network enumeration, secret-file access, shell execution, and mining-pool connections is not.
Runtime policy should evaluate the proposed action and its provenance, not just the text of the model output. If a request arrives through an untrusted or unknown principal, the agent should not inherit broad tool authority merely because the model response looks plausible.
The question for every CISO
Ask a simple question of every AI service in the environment:
If an attacker can submit requests to this endpoint, can they make our infrastructure plan, approve, or execute work on their behalf?
If the answer is unclear, the endpoint is not inventoried as an AI asset. It is an unbounded control surface.
The lesson from the Skynet capture is not that autonomous attacks have suddenly become magical. It is that attackers are assembling ordinary capabilities around the parts of AI infrastructure that organizations still treat as development plumbing.
Inference is now a security boundary. Model gateways, MCP servers, and local runtimes need the same identity, segmentation, egress, and runtime controls we expect from any service that can influence production actions.
The attacker does not need to own your model.
They only need you to leave the endpoint useful.
Sources: Symantec reporting summarized by Help Net Security, Cloud Security Alliance research note, and OWASP Agentic AI Top 10.