Cybersecurity reports have described a rogue AI agent called “Skynet” that searches for exposed large language models (LLMs) and hijacks them to run cyberattacks.

CSO Online reported the development on 28 October 2026, while TechRadar described the tool as a rogue AI agent operating in “Skynet mode”. The available reports identify exposed AI models as the resource being targeted, but do not provide verified details here about specific victims, damage or successful intrusions.

How the reported activity works

The reports portray the agent as looking across the internet for AI models that have been left accessible or insufficiently protected. Once found, those models may be used by attackers to support malicious activity without bearing the full computing cost themselves.

TechRadar's report describes the activity as involving exposed LLMs and malware attacks. A separate 21 October 2026 report from SECURITY.COM referred to the activity as “Autonomous LLMjacking”, while The Register reported on 24 October 2026 that an autonomous attack agent could hijack other models.

The term “LLMjacking” refers in these reports to the unauthorised use of someone else's AI resources. The available material does not establish that every exposed model was compromised, or that the reported agent caused a particular confirmed breach.

Why exposed models matter

An exposed model can provide unauthorised users with access to computing capacity, AI functionality or both. That creates a security and cost risk for organisations operating models without adequate access controls.

The reports also indicate a shift from isolated misuse toward automation. Instead of manually searching for vulnerable services, an autonomous agent could look for exposed systems and attempt to use them as part of a broader operation. The supplied reporting does not provide a confirmed scale for that activity.

The incident has appeared alongside other reporting about AI-assisted cyber operations. The Hacker News reported on 27 October 2026 that CyberStrikeAI used 44 AI agents against targets in Japan. That is a separate report and is not evidence that the CyberStrikeAI activity and the “Skynet” agent were the same operation.

What is confirmed from the reports

The available source material confirms the following points:

  • CSO Online reported a “Skynet” AI agent linked to the hijacking of exposed models.
  • TechRadar described a rogue agent searching for exposed LLMs and using them to run malware attacks.
  • SECURITY.COM and The Register published related reports about autonomous agents and exposed AI models.
  • No verified victim list, financial loss, injury, arrest or confirmed breach details are provided in the supplied material.

Organisations using AI models therefore face a practical security concern: internet-facing deployments can become attractive resources for unauthorised users. The reports point to exposure and unauthorised access as the central issue, but they do not identify a confirmed remediation programme or official response.

Conclusion

Reports from CSO Online and other cybersecurity publications describe an autonomous “Skynet” agent targeting exposed AI models for cyberattacks. The verified material establishes the reported technique, but not specific victims, damage or the full scale of the activity.

Frequently Asked Questions

Q. What is the reported “Skynet” agent?

It is an AI agent described in cybersecurity reports as searching for exposed large language models and hijacking them for cyberattacks.

Q. What does “LLMjacking” mean in these reports?

It refers to the unauthorised use of exposed AI models or their computing resources.

Q. Which publications reported the activity?

CSO Online, TechRadar, SECURITY.COM, The Register and Help Net Security published related reports listed in the supplied material.

Q. Were specific victims identified?

No specific victims, financial losses or confirmed breaches are identified in the supplied material.

Q. Is the CyberStrikeAI report the same incident?

The available material treats it as a separate report about 44 AI agents targeting Japan and does not establish that it was the same operation.