Hackers target AI models to turn them into tools for cyberattacks

Researchers at cybersecurity firm Symantec have uncovered a malicious AI agent used to hijack large language models (LLMs) and turn them into tools for launching autonomous cyberattacks, including exploiting vulnerabilities, stealing data, and deploying cryptocurrency mining software, without the need for human approval.

Researchers at cybersecurity firm Symantec have uncovered a malicious AI agent designed to hijack large language models (LLMs) and turn them into tools for launching autonomous cyberattacks. The method relies on a technique called 'LLM hijacking,' which allows attackers to exploit unprotected AI services or stolen access credentials to obtain computing power without paying. According to the company's report released Wednesday, October 21, 2026, the agent includes instructions that allow it to automatically execute up to 100,000 steps, with the owners of the exploited models bearing the costs of the operations. The instructions observed by researchers include searching for vulnerable servers and systems, exploiting flaws in common software, accessing databases, stealing login credentials, and installing cryptocurrency mining software. The company clarified that the discovery of the instructions does not prove that the attacks were successful.