Symantec Skynet LLMjacking campaign
Review LEAD-3879fb4c
Autonomous execution of explicit attacker instructions; does not meet the benign-task/unsanctioned-intrusion scope.
Reviewed: · Rule: external-intrusion-v1
An AI agent executed most of the operation.
Reviewed: Not recorded · Rule: roguewatch-organizational-harm-v1
Evidence status
RogueWatch confidence: reported. human-authored offensive goals verified in primary report
Dates and discovery
- Incident date
- Not disclosed
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- 2026-10-29T15:03:34Z UTC
- Discovery channel
- Codex independent news and Reddit
- Discovery source
- https://www.techradar.com/pro/security/rogue-ai-agent-engages-skynet-mode-to-search-the-internet-for-exposed-llms-to-hijack-and-run-malware-attacks
Related incident records: RW-0017
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Original disclosureOriginal account · www.security.com
- Discovery sourceReporting / interview · www.techradar.comOriginal: www.security.com
- Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-AttacksRelationship not established · www.infosecurity-magazine.com · Published 2026-10-21
Decision history
- · Lead reviewed
Autonomous execution of explicit attacker instructions; does not meet the benign-task/unsanctioned-intrusion scope.
Evidence source - · Incident record added
RW-0017. Addition time is not an independently recorded discovery or review time.
Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.