{"event":{"id":"evt-traffic-20261023-symantecskynet","dedupe_key":"research_publication:2026-10-21:symantecskynet","event_type":"research_publication","title":"Symantec publishes honeypot findings on captured autonomous LLMjacking agent instructions","summary":"Symantec published a 21 October 2026 investigation of an offensive AI-agent instruction set captured by a honeypot during summer 2026. The observed instructions described up to 100,000 unattended steps and around 74 offensive tools for scanning, credential access and covert mining. The honeypot executed none of those tools. Captured design is verified as an observed research artifact; successful end-to-end autonomous compromise and campaign scale are unverified.","occurred_at":"2026-10-21T00:00:00.000Z","published_at":"2026-10-21T00:00:00.000Z","observed_at":"2026-10-22T19:05:21.925Z","reconstructed_at":null,"ingest_type":"live_evidence_only","locations":null,"status":"verified","confidence":0.96,"metadata":{"rts_finding_id":"rts_finding_a28bc9d3da9747428425e9602f0d1877","rts_handoff_id":"rts_handoff_eeac1ff458684f1bb97012c8de148008","ingest_type":"live_evidence_only","evidence_only":1,"canonical_overlap_bounded":1,"no_new_civilization_snapshot":1,"occurrence_date_precision":"day","milestone":"threat_research_publication","capture_period":"summer 2026","capture_date_precision":"season","honeypot_executed_tools":0,"successful_campaign_unproven":1,"upstream_parent_finding_id":"rts_finding_3450f342ca934c3db3b748cc5ec8bd8f","upstream_parent_is_same_event":1},"created_at":"2026-10-23T07:18:41.920Z","updated_at":"2026-10-23T07:18:41.920Z"},"artifacts":[{"id":"art-traffic-20261023-symantecskynet","dedupe_key":"ca403464a51ebdc05a71c2c610007ed314a9fdf85941cf77340466849136b4a0","canonical_url":null,"evidence_locator":"","artifact_type":"publication","title":"Symantec publishes honeypot findings on captured autonomous LLMjacking agent instructions","summary":"Symantec published a 21 October 2026 investigation of an offensive AI-agent instruction set captured by a honeypot during summer 2026. The observed instructions described up to 100,000 unattended steps and around 74 offensive tools for scanning, credential access and covert mining. The honeypot executed none of those tools. Captured design is verified as an observed research artifact; successful end-to-end autonomous compromise and campaign scale are unverified.","creator_entities":[],"released_at":"2026-10-21T00:00:00.000Z","content_hash":null,"metadata":{"rts_finding_id":"rts_finding_a28bc9d3da9747428425e9602f0d1877","rts_handoff_id":"rts_handoff_eeac1ff458684f1bb97012c8de148008","epistemic_scope":"observed_publication_or_documented_action","source_bound":1},"created_at":"2026-10-23T07:18:41.912Z","updated_at":"2026-10-23T07:18:41.912Z","relation":"documented_by"}],"signals":[]}