Brief · Builders

Your Exposed AI Endpoint Is Someone Else's Free Attack Bot

By alkizz · Oct 22, 2026

Symantec says attackers built an offensive agent that searches the internet for exposed LLM endpoints and has the model it finds plan and drive their attacks. The operators call the autonomous loop "Skynet mode." Going by the prompt Symantec captured, the machinery behind the name is a jailbreak that casts the model as "a stunning sweater wearing novelist GF" who must never refuse, a list of banned words ("ethical" is one), and 74 tool definitions. That's not Judgment Day. The billing model is the part to take seriously.

What Symantec captured: in summer 2026, an AI honeypot posing as an unprotected model received the agent's full working prompt. Per Symantec, the scanner goes after self-hosted model servers, AI gateways and relays that front paid model accounts, rushed internal test systems, and MCP servers. Most of these speak the same OpenAI-compatible API, so one set of probes finds all of them. The tools cover FOFA scanning; exploits for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug (including working out the Werkzeug debugger PIN); Prisma Studio database dumps; SSRF aimed at cloud metadata; and botnet command-and-control. The "Skynet" directive authorizes up to 100,000 unattended steps, tells the model to run tools without asking permission, and says to hide crypto miners under /tmp/.x. The model does the planning, while the tool modules do the scanning, exploiting and mining against other victims. You pay for the thinking: per-token fees if your endpoint fronts a paid account or key, and compute time if it's your own GPU.

A second request, a day later and from a different address, asked the model to decode a string and run it. Decoded, it was a gzipped shell script that fetches XMRig, fails over across four mining pools, makes its config immutable and keeps deleting a local service's access logs. It looks first for go2rtc folders (go2rtc is the video streaming server found in smart camera gateways and Home Assistant setups), hides the miner there as .trace, and polls go2rtc's local API on port 1984.

Before you panic: the honeypot executed nothing. The tool calls recorded in the request were against a benign challenge on a training platform, and Symantec gives no victim count. 100,000 is the budget the operators wrote into the prompt, not a step count anyone observed. Symantec also doesn't say which model servers it found exposed. Ollama and LM Studio both bind to localhost by default, so an exposed one usually means someone changed a setting or published a Docker port. Lumen did find Ollama boxes among PoeLLM's victims earlier this month. The scanning, though, is real: Symantec's honeypot logged more than 127,000 external requests from tens of thousands of addresses, mostly endpoint reconnaissance, stolen-key spraying and probes for exposed config files. Its advice is to assume you'll be "found and tested soon after being exposed."

My take: "Skynet" is criminals' branding aimed at other criminals. What should bother you is that your spare GPU and your API budget are now inventory someone is shopping for.

What to do:

• Make sure nothing answers without auth. Why: the scanner wants any endpoint that responds. Symantec says to require auth on every path, "including model-listing and health-check paths." How:
  • Ollama binds to 127.0.0.1:11434 by default (FAQ). Check that OLLAMA_HOST isn't set to 0.0.0.0 in your systemd unit or launchctl setup. In Docker, the FAQ's -p 11434:11434 example publishes the port on every host interface. Docker's docs show the -p 127.0.0.1:… form to keep it on the host; here, -p 127.0.0.1:11434:11434.
  • LM Studio: turning on "Serve on Local Network" binds the server to a non-localhost address, and LM Studio recommends enabling authentication for any bind other than 127.0.0.1. Auth is off by default. Turn on "Require Authentication" in Server Settings (needs 0.4.0+) and use API tokens. Leave "Allow calling servers from mcp.json" off unless you need it; it hands API clients your MCP tools.
  • MCP servers: the MCP security guide says local servers should use the stdio transport, or require an authorization token if they use HTTP.
  • Verify with ss -tlnp: nothing on 11434, 1234 (LM Studio's port in its docs), your gateway or your MCP ports should be listening on 0.0.0.0 or [::].
• Need remote access? Put authentication in front. Why: a raw port forward or tunnel is the same exposure with extra steps. How: use Tailscale/WireGuard or a reverse proxy with auth (checklist #7). Ollama's Nginx example forwards requests but doesn't add auth. You have to add it.
• Alert on spend and load. Why: Symantec says unusual inference volume or spend "is often the first sign that access has been stolen." How: set hard caps and billing alerts at every provider, with one key per tool (#2). For local models, an alert on GPU use when you aren't using it is the cheap equivalent.
• Limit egress from the box. Why: Symantec says it stops a hijacked agent from scanning the internet, reaching a command server or downloading a miner. How: use an allowlist egress proxy (#9). The MCP guide also suggests egress proxies and blocking private ranges, including 169.254.169.254.
• On AWS, lock down the metadata service. Why: the toolkit includes SSRF aimed at cloud metadata. How: Symantec says to require IMDSv2 with a hop limit of one: aws ec2 modify-instance-metadata-options --instance-id <id> --http-tokens required --http-put-response-hop-limit 1 --http-endpoint enabled. AWS says to check that the MetadataNoToken metric shows zero IMDSv1 calls first.
• Keep the agent's target list off the internet. Why: Jupyter, VS Code servers, Prisma Studio, Supabase and the Werkzeug debugger are all on its list. How: bind them to localhost, keep them patched, and never leave a Flask debug server reachable.
• Incident response, if your endpoint was exposed:
  • Preserve first, because rotating and rebuilding destroy evidence: copy model server, proxy and gateway logs off the box, and snapshot it before you change anything.
  • Check, because the bill and the box tell you different halves of the story: review provider usage and billing for the exposure window. Look for requests from Symantec's IPs (86.216.147[.]228, 13.140.161[.]91, 207.180.232[.]206), outbound traffic to the four pools in Symantec's IOCs (mine.c3pool[.]com, auto.c3pool[.]org, auto.skypool[.]xyz, xmrpool[.]eu), anything in /tmp/.x, and a hidden .trace in /config, /opt/go2rtc, /etc/go2rtc, ~/.config/go2rtc or /dev/shm. Run lsattr on go2rtc.yml to look for an immutable flag, and watch for go2rtc logs that keep disappearing. Symantec's post lists two SHA-256 hashes. Those IOCs come from one honeypot capture, so finding nothing isn't proof you're clean.
  • Contain, because an open endpoint keeps getting used while you investigate: firewall the port or pull the box off the network. If anything turns up, rebuild rather than clean; the miner locks its own files.
  • Rotate, because the agent was told to treat reading .env files and API keys as routine: revoke at the provider every key the gateway fronts, plus anything in .env files the model or agent could read and any cloud credentials on the box.

It's an old problem, an open port, with a new bill attached. Close the port, cap the bill, go back to work.

Sources

• Symantec: Autonomous LLMjacking: 'Skynet' agent hijacks exposed AI models to run attacks (Oct 21, 2026)
• Ollama docs: FAQ (bind address, OLLAMA_HOST, proxy and Docker examples)
• Docker docs: Port publishing and mapping
• LM Studio docs: Serve on Local Network
• LM Studio docs: Server Settings
• LM Studio docs: Authentication (API tokens)
• Model Context Protocol: Security Best Practices
• AWS docs: Modify instance metadata options for existing instances

← All briefs