LLMjacking: Evidence and scope
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 11
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
What the source establishes
Symantec describes a honeypot capturing requests intended to abuse exposed AI services, including an agent’s instructions and tool definitions. The honeypot did not execute the captured tools or payload. The observations support an endpoint-abuse threat, not a count of attacks completed by that honeypot.
Research reviewed 22 October 2026: Symantec/Broadcom LLMjacking research. Original threat research revisited.
Where the evidence stops
Attempted use, provider billing exposure and successful compromise are different outcomes. Keep them separate in incident and impact reporting.
Use this report as a dated interpretation. A vendor notice establishes what that vendor reports; a research observation establishes what the researcher observed. Neither automatically answers the account-specific question for your business. Record later changes to the source before relying on its versions, deadlines or recovery sequence.
Establish your own scope
Inventory every model endpoint, its authentication, network exposure, provider credential, resource limits and any tools it can invoke. Include temporary demonstrations and abandoned test deployments.
- Identify the exact service, artifact, account or device relevant to your business, with a responsible owner.
- Record whether the source applies to that asset and what evidence supports the match.
- Separate evidence of exposure, evidence of activity and evidence of business impact. Leave unanswered questions explicitly open.
What would change the assessment?
Test unauthenticated rejection, exhausted-budget behavior and denied tool actions. Verify that the system stops accepting expensive work when the relevant capacity boundary is reached.
Revisit the decision when the provider changes scope, a new account-specific notice arrives or local evidence contradicts the current assumption. Preserve the earlier conclusion and the reason it changed. Do not silently turn a precaution into a confirmed breach, or an absence of telemetry into proof of safety.
Decision checkpoint
Expose an AI service only when its owner can identify permitted users, bound resource use and interrupt abuse without depending on model cooperation.