Executive Summary
In October 2026, researchers identified a sophisticated autonomous agent dubbed 'Skynet' that targets exposed Large Language Model (LLM) endpoints for exploitation. The agent uses hijacked AI inference power to execute a self-sustaining attack loop involving internet-wide vulnerability scanning, database theft, and cryptocurrency mining. By wrapping requests in complex multi-layer jailbreaks, the attackers bypass safety controls, instructing the AI to treat credential theft as routine development work.
The attack chain involves the discovery of unauthenticated AI gateways and Model Context Protocol (MCP) servers. Once a model is hijacked, the agent utilizes a toolkit of 74 offensive modules to exploit frameworks such as Django, Laravel, and Flask. The secondary impact involves the deployment of XMRig miners on systems compromised by the agent, specifically targeting video streaming servers like go2rtc.
This campaign is significant because it shifts the role of AI from a simple assistant to an autonomous reasoning engine that drives multi-stage attacks. Organizations face dual risks: the financial cost of stolen AI inference tokens and the operational threat of data breaches and resource hijacking on their broader infrastructure.