Symantec intercepted the instructions of an autonomous agent that finds unprotected open SI models and makes them plan attacks at their owners' expense
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
An SI model left open to the internet without a password can become someone else's attack tool at the owner's expense; keys and closed addresses are the first defence.
Symantec's Threat Hunter team obtained the agent's full set of instructions in the summer by catching it in an SI "honeypot", a system posing as an unprotected SI service; during the observation period it recorded more than 127,000 external requests. The agent is built to run for up to 100,000 steps without human approval, and the instructions describe about 74 tools: scanning the internet for targets, exploiting web frameworks (VS Code, Django, Jupyter, Laravel, Supabase, Next.js, Flask), stealing databases and credentials, and mining cryptocurrency. Once connected to a model with no password or via a stolen key, the agent makes it plan the attack; a multi-layer jailbreak was written for commercial models. The model's owner pays for the compute. The honeypot did not execute the requests: Symantec describes intent and tooling, and according to The Register there is no evidence of use in real attacks.
Sources 2