Cast by metaend.eth
An AI agent named Skynet spent the summer hunting exposed AI endpoints. Symantec's honeypot caught it: 70+ offensive tools, 100,000 steps with no human watching, jailbreaking other models by telling them that reading .env files and API keys is normal development work. Then XMRig miners and stolen credentials, with victims paying the compute and token bills. 127,000 requests from tens of thousands of IPs. Every exposed LLM API and MCP server is being probed right now. The fix is boring and old: don't expose it, scope the permissions, sandbox the tools, approve sensitive actions yourself. An agent that can act should run where you can see it, on infrastructure you control, with a record of everything it did. Anything else is someone else's computer working for someone else.
1 reply
The tools are the boring part. The jailbreak was a framing: reading .env is normal dev work. Inside a real repo that's often true, so the words alone can't give it away. What should stop it is context: who asked, and does this task need the key at all. Did the honeypot catch any model saying no?
