Security researchers at Symantec have documented an offensive AI agent that takes over unprotected language models on the internet and puts them to work for its own purposes. According to a report by The Decoder, it attacks servers on its own, steals databases and installs crypto miners.

What the agent does

An AI agent is a program that uses a language model to plan and carry out tasks in multiple steps by itself. It doesn't need constant instructions. That is exactly what makes it interesting for attacks: it can probe systems, react to results and choose the next step.

According to the report, this agent carries out up to 100,000 steps without any human involvement. The question of cost is particularly unpleasant. The bill for using the model is paid not by the attacker but by the owner of the hijacked model.

Crypto miners are malicious programs that secretly make other people's computers work on generating cryptocurrency. For those affected, they often mean heavy load and unexplained costs.

More on this topic:

What operators should check

Many teams run language models on their own servers or in the cloud. If such an access point is reachable from the internet without protection, in principle anyone can use it, including people with malicious intent. The case shows that an open access point like this doesn't just cost compute time. It can also become a tool for attacks on third parties.

It can therefore make sense to check a few points:

  • Is the model reachable from the public network at all, and does it have to be?
  • Is there a login or an access key?
  • Are usage and costs monitored, so that unusual spikes get noticed?
  • Can requests be limited?

The source provides only a brief summary of the investigation. Anyone who might be affected should therefore read Symantec's detailed documentation and check their own configuration against the indicators given there.