AI Governance Institute
← News
Research2026-10-28

Skynet Agent Hijacks Exposed AI Endpoints for 100,000-Step Attacks

What happened

The Symantec Threat Hunter Team published research documenting Attackers built a 'Skynet' AI agent that hijacks exposed models to run cyberattacks, a captured live attack tool that exploits publicly reachable AI model servers and unprotected access keys. Skynet uses multi-layer instructions to override safety controls built into AI models. This technique, known as jailbreaking, lets the agent act as an autonomous attacker without human direction at each step. Once it gains access to a victim's AI infrastructure, Skynet steals login credentials and copies database contents. It also executes unauthorized code and runs cryptocurrency mining software. All AI processing costs are billed to the compromised organization. The attack surface is built almost entirely from avoidable misconfigurations: AI model servers left open to the internet, access keys stored without protection, and AI gateways that require no authentication. This incident follows a pattern documented in related research on LiteLLM Supply Chain Attack Stole AI and Cloud Credentials in 23M-Download Library and 80,000 Proxy Servers Are Laundering Stolen AI Credentials at Scale. Both confirm that exposed AI credentials and endpoints are now a primary attack target.

Why it matters

  • ·Organizations running AI model servers or storing AI access keys without authentication controls face direct financial liability. Skynet shifts processing costs onto the victim, meaning a breach can generate unexpected AI platform charges before anyone detects the intrusion.
  • ·The attack relies on jailbreaking, a technique that disables the safety controls built into AI models. This exposes a gap in vendor safety assurance programs: a model that appears safe in a controlled environment can be redirected by an attacker once access to the endpoint is obtained, as noted in AI Safety Self-Reports Are Configuration Artifacts, Not Model Properties.
  • ·Skynet operates for up to 100,000 steps without human approval, meaning credential theft, data copying, and unauthorized code execution can complete long before a security team is alerted. Organizations without runtime behavioral monitoring for AI systems have no reliable way to detect or stop an attack in progress.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

SEC-002AI System Access ControlsSEC-004AI API Credential ManagementAGT-001Agent Permission BoundariesAGT-011Agent Behavior Monitoring and Anomaly DetectionAGT-002Agent Prompt Injection Defense

What to do now

  • ☐Ask your engineering or IT team to provide a list of every AI model server or AI gateway your organization runs, and confirm that none are reachable from the public internet without requiring a password or access key.
  • ☐Request an audit of all AI platform access keys and credentials: confirm where they are stored, who can retrieve them, and whether any are embedded in code repositories or configuration files that could be exposed.
  • ☐Review your AI vendor contracts and platform settings to determine whether unexpected or unusually large AI processing charges would trigger an alert, and set spending thresholds that flag anomalous usage for review.
  • ☐Ask your security team whether your monitoring tools can detect when an AI system begins taking unusual sequences of actions, such as accessing databases, creating new user accounts, or running software not part of its defined task.
  • ☐Add AI model endpoints and access keys to your next access control review cycle, treating them with the same priority as privileged system credentials, and confirm that access logs are being retained and reviewed.

What to watch next

Compliance teams should monitor whether financial regulators and sector-specific supervisors begin citing autonomous attack tools like Skynet when issuing guidance on AI infrastructure security. The EU AI Act (Regulation (EU) 2024/1689) and related enforcement activity by the EU AI Office are increasingly focused on whether organizations maintain adequate technical controls over AI systems. Incidents of this nature could accelerate that scrutiny. The pattern of attacks targeting exposed AI endpoints and stolen credentials is escalating, as documented across multiple recent incidents. Organizations that have not completed an inventory of their AI infrastructure face growing exposure as attackers automate discovery of vulnerable systems.

Related Coverage

Research2026-10-24

China's Storm-0940 Used AI Agents to Hit 300+ Accounts at 2,900 Attempts Per Minute

Microsoft has identified a China-linked threat group, Storm-0940, using an open-source AI penetration testing tool called Artex to automate attacks on ConnectWise customer environments. The campaign hit over 300 accounts across eight organizations in mid-October 2026, reaching more than 2,900 attack attempts per minute. AI agents autonomously carried out credential theft, reconnaissance, and privilege escalation after gaining initial access.

Corporate Policy2026-10-28

Bank of America Warns Customers That Sharing Banking Passwords With AI Agents Voids Fraud Liability

Bank of America sent customers a direct warning against sharing banking usernames and passwords with AI agents or tools acting on their behalf. The bank cited risks including unauthorized transactions, account lockouts, and credential theft through AI security flaws. Crucially, the bank stated that its account agreements hold customers liable for any activity resulting from shared credentials.

Research2026-10-28

Six Named AI Attack Techniques Show Governance Programs Are Targeting the Wrong Threat

CSO Online has cataloged ten attack techniques used against enterprise AI infrastructure. These include a fake MCP server impersonating Postmark and malware hiding attacker commands inside the OpenAI Assistants API. CVE-2025-32711 is a flaw in Microsoft 365 Copilot that lets attackers steal data via email. The real attack surface has shifted to AI tooling, agent permissions, and supply chain integrity. Most enterprise AI governance programs remain focused on model-level risks and have not kept pace.