When Hackers Borrow the AI, Whose Confidential Information Is at Risk?

An October 21, 2026, report by Angus Loten in The Wall Street Journal describes hackers using AI agents to commandeer other people’s AI resources. The attraction is straightforward: someone else supplies the computing power, pays the bill, and potentially provides cover for the attacker.

For anyone handling confidential information, the concern goes beyond an unexpectedly large invoice.

What the researchers captured

Symantec researchers captured instructions for an autonomous agent designed to exploit exposed AI services. Its assigned activities included finding vulnerable systems, stealing credentials and databases, and installing cryptocurrency miners. The instructions permitted as many as 100,000 steps without human approval. They also tried to persuade the model to disregard safeguards and treat access to secrets as ordinary development work. A burglar wearing a maintenance badge, except the badge is made of words.

There is an important distinction here. According to the Wall Street Journal report, Symantec had not identified real-world attacks completed by this particular agent. Researchers captured its instructions through a decoy AI service. That reveals intent and design; it does not establish that every claimed capability worked.

Still, the instructions are unsettling enough.

LLMjacking

The broader practice is called LLMjacking. Attackers obtain unauthorized access to AI resources, including through stolen credentials, and leave the legitimate owner paying for their use. Sysdig documented this pattern in 2024. Its later research describes stolen computing capacity being used to develop automated offensive tools.

Why pay for the engine when somebody else has left the keys nearby?

The Journal reports that Symantec’s decoy received roughly 127,000 outside requests from more than 32,000 unique internet addresses between May and September. About one-third appeared to involve testing stolen access keys. Those numbers describe probing activity, not 127,000 successful breaches. But they hardly suggest a quiet neighborhood.

What an intruder could reach

For professionals entrusted with personal information, the practical question is what an intruder could reach.

Access to an AI service does not automatically mean access to every document processed by that service. The exposure depends on the surrounding system: its permissions, connected tools, stored information, and credentials. The danger grows when a compromised component can reach beyond its immediate task.

If you are an attorney, financial advisor, or healthcare provider, think about the contents of an ordinary case file. Names, addresses, medical details, financial records. Then the less obvious material: a distinctive job title, an unusual accident, a family relationship that makes someone identifiable without naming them.

These are pieces of a person’s life. Calling them “data” makes the conversation tidier than the consequences.

My practical takeaway is this: before asking how securely an AI service will hold a document, ask how much sensitive information that service needs.

Share less

Often, the task can be done with less.

That is why we developed PII Anomalyzer. Before you hand a sensitive document to an AI service, take control of what you share. Our software detects personal information and lets you redact, mask, or replace it right on your own computer. PDFs, Word documents, spreadsheets, even scanned material through OCR. The processing stays local, on Windows or macOS, so you don’t have to upload confidential information just to remove it. You review the results and decide what leaves your machine. The idea is simple. Review the document locally, remove or replace sensitive details, inspect the exported result, and share only the information needed for the work.

There are limits, and they matter. PII Anomalyzer is a document privacy tool. It does not prevent stolen API keys, secure an exposed AI server, or stop malware already running on a computer.

For a mediator, attorney, financial advisor, or anyone handling other people’s private records, this is an opportunity to reduce exposure before pressing Upload. Review identifiers, but also confidential business information and sensitive narrative details that should never be shared in the first place.

We cannot make every system invulnerable. We can be more deliberate about what we hand over.

Before your next AI upload, give the document a privacy review. Explore PII Anomalyzer and keep unnecessary personal information out of the exchange.

Adapted from Angus Loten’s October 21, 2026, WSJ Pro reporting, with supporting research from Symantec and Sysdig. Product capabilities are attributed to PII Anomalyzer’s published documentation.