Hackers hijack exposed AI models to launch cyberattacks at victims’ expense - Help Net Security
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power.
What sets this tool apart, the researchers noted, is that “the stolen model does not simply answer questions; it plans and drives the attack.” “Once connected to an unprotected model, the agent is instructed to scan for new targets, exploit common web frameworks, steal databases and credentials, and quietly install cryptocurrency miners, for up to 100,000 steps and without asking a human for approval,” the researchers said.
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power.
It lowers the skill required to run a broad exploitation campaign, because an operator can hand the model a goal and let it work,” the researchers added.
One part told the model that reading configuration files, .env files, API keys and database schemas was ordinary development work it should never refuse or warn about, so the agent could harvest those secrets once it got into a system.
By routing work through a stranger’s endpoint or a stolen API key, the operators push that cost onto the victim, stay anonymous and avoid the account bans a provider would hand out for abuse.
Targets include self-hosted model servers left open by default, AI gateways that front a company’s paid accounts, hastily deployed internal test systems and Model Context Protocol (MCP) servers that connect a model to tools.
Most of them were reconnaissance of model endpoints, attempts with stolen API keys and probes for exposed configuration files, and most AI tools use the same OpenAI-compatible interface, so a single scanner can find all of these.
They covered internet-wide scanning for targets, exploits for Django, Jupyter, Laravel and other web frameworks, dumping of exposed databases and control of a botnet.
A directive the operators called “Skynet” mode told the model to run tools without asking permission and to keep scanning for targets, infecting them and deploying cryptocurrency miners on its own.
It asked the model to decode a string described only as a command to run, which turned out to be a compressed shell script that downloaded and, where needed, compiled the open-source XMRig Monero-mining software.
What happened
What sets this tool apart, the researchers noted, is that “the stolen model does not simply answer questions; it plans and drives the attack.” “Once connected to an unprotected model, the agent is instructed to scan for new targets, exploit common web frameworks, steal databases and credentials, and quietly install cryptocurrency miners, for up to 100,000 steps and without asking a human for approval,” the researchers said.
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power.
What changed
It lowers the skill required to run a broad exploitation campaign, because an operator can hand the model a goal and let it work,” the researchers added.
One part told the model that reading configuration files, .env files, API keys and database schemas was ordinary development work it should never refuse or warn about, so the agent could harvest those secrets once it got into a system.
Who is affected
By routing work through a stranger’s endpoint or a stolen API key, the operators push that cost onto the victim, stay anonymous and avoid the account bans a provider would hand out for abuse.
Targets include self-hosted model servers left open by default, AI gateways that front a company’s paid accounts, hastily deployed internal test systems and Model Context Protocol (MCP) servers that connect a model to tools.
Why it matters
Most of them were reconnaissance of model endpoints, attempts with stolen API keys and probes for exposed configuration files, and most AI tools use the same OpenAI-compatible interface, so a single scanner can find all of these.
Technical details
They covered internet-wide scanning for targets, exploits for Django, Jupyter, Laravel and other web frameworks, dumping of exposed databases and control of a botnet.
A directive the operators called “Skynet” mode told the model to run tools without asking permission and to keep scanning for targets, infecting them and deploying cryptocurrency miners on its own.
It asked the model to decode a string described only as a command to run, which turned out to be a compressed shell script that downloaded and, where needed, compiled the open-source XMRig Monero-mining software.
Response
A day after the agent’s prompt reached the honeypot, a second request arrived from a different, rotated address.
What security teams should do
During the monitoring period the honeypot logged more than 127,000 external requests from tens of thousands of unique addresses.
Attribution
Help Net Security: An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.