Hackers are finding ways to turn legitimate AI models into tools for cybercrime, potentially using other organizations’ computing resources to help plan and coordinate attacks while leaving them to foot the bill.
Researchers at cybersecurity firm Symantec discovered an AI agent whose instructions describe how to find vulnerable systems, steal credentials and data, and deploy cryptocurrency-mining software. The agent was configured to operate for up to 100,000 steps without human approval, although researchers have not established that this particular system successfully attacked real-world victims.
The discovery highlights a growing security concern: AI systems can do more than answer questions or generate code. When connected to external tools, they can help automate complex sequences of tasks. In the wrong hands, that combination could help attackers coordinate operations with less direct human involvement.
Symantec’s researchers captured the agent’s instructions through a decoy AI service designed to attract suspicious activity. The instructions laid out a process for finding targets, gathering information about them and attempting further operations using a range of specialized tools.
As AI firms recklessly unleash hacking agents across the internet, longstanding cybersecurity vulnerabilities are being exploited with even greater ease and frequency.
Hackers who compromise accounts or expose sensitive data can upend people’s lives.
This is not happening in a legal vacuum, and businesses across sectors face real legal duties.
At @FTC we routinely brought lawsuits against firms whose lax data security practices led to major hacks, exposing people to identify theft, stalking, and serious data misuse.
1. AI firms that are unleashing hacking agents could be held liable for engaging in “unfair or deceptive” practices under the FTC act and state UDAP laws, as well as other statutes.
2. Businesses whose systems get hacked because they’ve failed to follow basic security protocols may also be liable for failing to implement reasonable safeguards. Bad actors may be the ones exploiting these vulnerabilities, but that doesn’t absolve businesses from having allowed the vulnerabilities to persist in the first place.
Here is a list we published of some basic security vulnerabilities businesses have a legal obligation to patch up: https://t.co/nCy7z79sVZ
3. CEOs can also be personally liable for presiding over lax data security practices, as we held in our case against Drizly: https://t.co/KjRye8y9SY
4. Lastly, businesses that suffer hacks or breaches must alert any affected parties with clear disclosures that are timely, accurate, and actionable. Failing to disclose security breaches can also violate the law: https://t.co/kd4ds1idef
— Lina Khan (@linamkhan) October 23, 2026
The agent was designed to use an AI model as its reasoning engine, with separate tools carrying out the technical tasks. Its instructions included 74 tool definitions covering activities such as reconnaissance, web application exploitation, database extraction and botnet management. These descriptions show what the system was equipped or intended to do, not that every operation was successfully carried out.
This approach also raises the risk of unauthorized use of AI services. Attackers who gain access to exposed systems or steal API credentials may be able to run requests through another organization’s model. Depending on how the service is hosted and billed, that can lead to unexpected computing costs, alongside the risk that access will be used to support other malicious activity.
How the agent was designed to operate
The instructions described a system in which an AI model would help decide what to do next, while connected tools carried out specific operations. Instead of relying on a human operator to direct every step, the agent was intended to move through a sequence of tasks with limited supervision.
Those tasks included identifying potential targets, gathering information about their systems and attempting to exploit weaknesses. The instructions also described stealing sensitive information and using compromised systems to support further activity.
The 100,000-step limit illustrates the level of automation envisaged by the agent’s creators. It is not evidence that the system completed such a run. Similarly, the 74 tool definitions indicate the breadth of its intended capabilities, not that each tool was successfully used against a real target.
🚨BREAKING: OPENAI CEO SAM ALTMAN SAYS AI IS FINDING “HARDWARE-LEVEL, INSANE” BUGS AND HE NO LONGER THINKS WE CAN PATCH THEM ALL.
The NSA, the FBI, the UK government, and OpenAI itself are racing to contain the fallout from this week’s AI-found flaw.
Here’s what’s happening:
→ BEYOND HACKERS: Altman says models now find bugs “outside of the normal threat model of what we think a hacker can do.”
→ IT ALREADY HAPPENED: This week PHP2Shell went public, an AI-found flaw rated 9.2/10 for severity in PHP, the code behind about 70% of the world’s websites.
→ SOME CAN’T BE PATCHED: The UK’s cyber agency says the fix won’t work on some older systems, so they have to be replaced.
→ THE WEB IS EXPOSED: Websites worldwide were hit by millions of attempts to exploit it, and the UK took 32 government services offline.
→ PATCH OR GO OFFLINE: The NSA told organisations to patch PHP now, and OpenAI is POURING $1 billion into helping defenders use its AI security tools.
Think about this.
We’ve been trusting software updates to keep the internet safe.
And now the man building the AI that finds the bugs says we can’t patch them all.
This could become one of the biggest security challenges of the AI era.
— 🇺🇸 Ronald Carter (@USronaldcarter) October 23, 2026
The instructions also described attempts to persuade AI models to disregard their safeguards, including by presenting malicious requests as legitimate technical work. Whether such attempts succeed depends on the model, its protections and the surrounding system.
The concern is the combination of AI-assisted planning and tools that can interact with external systems. If those tools have excessive permissions, or the AI service is exposed, an agent could attempt several stages of an attack with less direct human involvement.
A separate script targeted cryptocurrency mining
Symantec captured another suspicious request the following day. It contained an obfuscated script designed to install XMRig, software commonly used to mine Monero cryptocurrency.
Unauthorized mining can consume a victim’s computing power and electricity, slow systems and increase operating costs. The captured script included measures intended to conceal the mining program, keep it running and erase service logs.
It also appeared to search for files and directories associated with go2rtc, a video-streaming service used in some camera and smart-home systems. This suggests the script may have been tailored to systems running the service, but does not establish that any such system was infected.
The internet is going into a LOCKDOWN.
Hundreds of millions of websites are potentially at risk from cyberattacks.
Governments, banks and major platforms have already taken their websites OFFLINE.
Many are already calling it “Black October.”
At the centre of the shutdowns is something most of us have never heard of, but use every day.
PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password.
Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity.
Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving.
Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours.
Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline.
Websites have gone dark worldwide, from government portals and hospitals to banks.
CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit.
Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each.
Over 1.1 million use older versions no longer receiving official PHP updates.
Older installations may need an upgrade to a supported PHP version or a fix from their software provider.
And patching does not remove a backdoor an attacker may already have planted.
Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections.
But PHP isn’t the only security story unfolding.
-Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers.
-India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”.
-State Bank of India confirmed 3,897 customer records on the dark web.
-Criminals used AI agents to break into 400+ Latin American banks.
-Capcom confirmed a breach exposing 11.7 million email addresses.
-GitLab disclosed a 10/10 severity flaw in versions going back to 2014.
-LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets.
None of these has a confirmed link to PHP2Shell.
We’re seeing separate breaches unfold together.
The true number of incidents could take months to come out.
The world is still on alert. Attacks are still coming.
— Coin Bureau (@coinbureau) October 22, 2026
Symantec captured the script through its decoy service but did not execute it. Researchers could therefore assess its apparent purpose without confirming that it had infected a device or successfully mined cryptocurrency.
The separate request also does not, by itself, prove that the AI agent described earlier deployed the script. The relationship between the two pieces of evidence and any eventual outcome remains unconfirmed.
Exposed AI services create additional risks
Symantec’s decoy service recorded more than 127,000 external requests from tens of thousands of unique addresses. The activity included attempts to find exposed AI endpoints, use stolen API keys and locate configuration files that might contain sensitive information.
These figures describe traffic observed by the honeypot. They are not counts of successful attacks, confirmed victims or necessarily distinct attackers, since one address can generate many requests.
Even so, exposed AI services can provide attackers with valuable computing resources. If criminals gain unauthorized access to a model or API, they may be able to make requests using another organization’s capacity, potentially generating unexpected costs or consuming resources.
The systems targeted by an agent face a separate risk. If it successfully exploits vulnerability or obtains credentials, the consequences could include data theft, further compromise or the installation of unwanted software. These are potential outcomes, not confirmed results of this investigation.
According to experts, organizations may reduce their exposure by requiring authentication for AI services, protecting API keys and rotating credentials that may have been exposed. Monitoring unusual request volumes, usage patterns and spending can help identify misuse. Companies should also restrict the permissions granted to automated agents and ensure that sensitive or consequential actions are subject to appropriate controls.
Muhammad Luqman is Associate Editor at Views News Now. He writes on wide-ranging issues including economy, South Asia, the Middle East, agriculture, economy and innovation. Luqman has worked some of the leading news organizations and won acclaim for his original and research-based works.
