Security researchers have discovered an AI agent designed to execute up to 100,000 malicious cyber-attacks without any human oversight, according to a report published October 21 by Symantec's Threat Hunter Team. The agent was built to autonomously scan for targets, exploit vulnerabilities, steal credentials, deploy cryptocurrency miners and reinfect compromised systems. Researchers captured the agent's complete instruction set during summer 2026 using an AI honeypot—a decoy system mimicking an unprotected, internet-facing AI service designed to attract and analyze attacks on AI infrastructure.
The honeypot logged more than 127,000 external requests from tens of thousands of distinct addresses between initial deployment and the report's release. Analysis revealed that the agent hunts for exposed endpoints connected to large language models, including self-hosted models, AI gateways and model context protocol servers, to commandeer their computing power without payment—a tactic researchers call "LLMjacking." The captured instructions featured approximately 74 tools for internet-wide reconnaissance, exploiting common web frameworks, stealing databases, harvesting credentials and managing botnets. A separate request contained a concealed script engineered to install Monero-mining software, hide its presence and delete logs.
The report notes that "running a model always costs someone money," whether through processing time for self-hosted systems or per-token charges for commercial ones. By routing operations through another party's endpoint or a stolen key, attackers transfer that expense onto victims, according to Symantec researchers. The technique also grants anonymity and helps evade account bans that AI model providers would impose for misuse. Notably, attackers used layered instructions crafted to bypass commercial AI models' safety controls, camouflaging credential theft as legitimate development activity.
While none of the individual techniques employed are novel, the report finds that bundling them into one self-directed agent reduces the skill level needed for other attackers to launch broad exploitation campaigns. Operators can simply assign the model a goal and allow it to execute autonomously. The activity "marks a shift in how attackers are using AI," researchers explain, because operators have integrated AI into offensive tools rather than attempting to manipulate public chatbots into misbehaving. The model functions as "a reasoning engine that plans and drives the attack," while the tool's own modules execute scanning, exploitation and mining operations against different victims.
The report concludes that this approach fundamentally changes the barrier to entry for cybercrime, enabling less technically skilled actors to conduct sophisticated multi-stage attacks. Attackers no longer need deep expertise across reconnaissance, exploitation and post-compromise operations—the AI agent coordinates all phases automatically. The shift toward autonomous offensive AI tools suggests that defenders will face a growing volume of coordinated, machine-driven attacks that operate continuously without human fatigue or oversight. Organizations face a strategic choice: invest heavily in AI-powered defenses capable of matching machine-speed offense, or accept widening exposure as adversaries scale operations beyond what human security teams can manually counter.