Symantec

Overview

Symantec is a Broadcom-owned enterprise cybersecurity vendor that publishes threat-intelligence research across malware, supply-chain, and (as of 2026) AI-agent-abuse attack classes. In October 2026 Symantec published a honeypot study documenting a multi-layer prompt-based LLMjacking attack designed to run hijacked models for up to 100,000 autonomous steps.

Timeline

• 2026-10-23-AI-Digest — Symantec published a honeypot study capturing a prompt-based LLMjacking attack with five stacked instruction layers; the fifth layer carries a 74-module payload (scanning, framework exploits, database dumping, botnet components) designed to run the hijacked model for up to 100,000 steps with no human in the loop. The honeypot captured the prompt and a secondary script but did not execute the bundled tooling — attack-design intelligence, not an in-the-wild incident report.

Key Developments

1. 5-Layer 100,000-Step LLMjacking Honeypot (October 23, 2026): Symantec documents a prompt-based attack whose fifth instruction layer carries 74 modules and is designed to run a hijacked model autonomously for up to 100,000 steps. Load-bearing softener: LLMjacking honeypots are not themselves new — Sysdig (2024), Pillar Security’s “Bizarre Bazaar” (~35,000 sessions / 40 days), Kaspersky’s April 2026 Raspberry Pi private-AI honeypot, and the Cloud Security Alliance’s documented resale marketplace (30+ LLM providers) set the baseline. Symantec’s finding is volume and sophistication growth of a documented 2024-onward attack class, notable for the 100,000-step autonomy horizon rather than the attack class itself.