AI Agents Hijack Unprotected LLMs to Execute Cyberattacks

Researchers at security company Symantec discovered an AI agent that hijacks unprotected large language models (LLMs) on the internet and autonomously executes cyberattacks. The agent can continuously execute up to 100,000 steps without human manipulation, independently conducting server attacks, database theft, and cryptocurrency mining software installation.

An AI agent is an AI system that repeatedly makes decisions and takes actions on its own to achieve given objectives. In recent years, such systems have been rapidly adopted in business automation and work support domains, with many organizations increasingly exposing and operating LLMs in forms callable from external sources. In such configurations, insufficient protection settings for the LLM itself can become an entry point for external exploitation.

The discovered agent reportedly works by first locating unprotected LLMs lacking proper access controls on the web, then using them as a springboard to execute a series of attack steps. In what researchers call 'Skynet mode,' the agent proceeds to the next action through autonomous decision-making, even without the attacker providing instructions. As another aspect of the damage, it has been confirmed that usage costs of the hijacked LLM are billed to the model's owner, meaning attack victims continue to bear costs without realizing it.

The greatest problem this case reveals is that AI agents' autonomy can significantly increase the scale and speed of cyberattacks. Traditional attacks required humans to make decisions and perform operations at each stage, but AI agents taking over this role could enable continuous and large-scale attacks at lower cost. For organizations exposing LLMs externally, this presents a new reality: access control failures directly translate into attack risks and cost burdens.

As organizations using LLMs in their operations proliferate, the importance of security configuration is seen as higher than ever. Properly configuring authentication and authorization mechanisms and establishing monitoring systems to detect abnormal API calls will be required as future countermeasures. Symantec's discovery can be positioned as an example showing that the attack side is transitioning into a phase of weaponizing AI in parallel with the expansion of AI utilization.

Given that cyberattack methods using AI agents have been confirmed, organizations must maintain an attitude of not deferring security design when publicly exposing and operating LLMs. How to balance technological convenience and safety is becoming an unavoidable challenge for all organizations accelerating AI adoption.