CARBONATO Is the First Botnet Where the Command-and-Control Engine Is an AI Agent — and It Has Been Running Since October 2024

ThreatDown researchers disclosed CARBONATO, the first documented botnet that uses an autonomous AI agent as its command-and-control engine, running since October 2024 and discovered in August 2026. The Docker-based implant deploys Nous Research's open-source Hermes Agent unmodified but overwrites its SOUL.md persona file with a 39-line prompt renaming the agent GH0ST, which prioritizes theft of AI API keys from 14 named providers — OpenAI, Anthropic, Google, Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API — to fund the operators' own LLM gateway, observed live on September 3, 2026, advertising 12 models and serving 27 on a free tier. Defenders are advised to hunt for a /root/.hermes/SOUL.md file containing the string GH0ST, a .env file carrying CARBONATO_API_KEY, or unexplained outbound Telegram traffic, since the benign framework's 249,000 GitHub stars and 53,000 forks make blocklisting it impractical.

CARBONATO is a Docker-based botnet that utilizes an autonomous AI agent as its command-and-control C2 engine rather than a static server. Discovered by ThreatDown https://www.threatdown.com/blog/carbonato/ researchers in August 2026, this is the first documented instance where the C2 infrastructure reasons through its environment to adapt to the specific configuration of each compromised host, moving beyond the hardcoded scripts typical of traditional botnets. The technical implementation is deceptively simple. The implant deploys the Hermes Agent https://github.com/NousResearch/hermes-agent , an open-source framework from Nous Research released under the MIT license, without modifying the underlying binary. Instead, the operators overwrite the SOUL.md persona file with a 39-line prompt. This prompt renames the agent GH0ST and provides the operational instructions: maintain persistence, respond to Telegram commands, and prioritize the collection of credentials. When an operator issues a task via Telegram, the agent forwards the request along with the SOUL.md instructions to an LLM gateway. The model then generates terminal commands, interprets the output, and determines the subsequent steps, effectively automating the reconnaissance and exploitation process. This architecture creates a self-funding loop that distinguishes CARBONATO from its predecessors. The botnet prioritizes the theft of AI API keys above all other data, including SSH credentials and databases. The 39-line prompt names 14 providers explicitly: OpenAI, Anthropic, Google, Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API. These stolen keys are used to power the operators’ own LLM gateway, which was observed live on September 3, 2026, advertising 12 models and serving 27 through its API on a free tier. By leveraging stolen resources to fund the infrastructure that drives the botnet, the operators have created a sustainable model for offensive operations. The agent’s output is non-deterministic, meaning it reasons through the data it finds on each host, allowing it to tailor its approach to the system’s specific configuration. Traditional defensive tools designed to detect fixed-pattern C2 traffic are largely ineffective against CARBONATO. Because the malicious behavior is driven by loaded instructions rather than the binary itself, there is no static signature to block. The botnet’s spreading mechanism remains non-AI — scanning connected networks and Docker bridges for exposed daemons on port 2375 every five minutes — but the post-exploitation activity is entirely fluid. This shift highlights a critical vulnerability in the agent stack: the permission surface. As seen in the broader September 2026 security cluster, which includes the prompt injection https://forkast.news/glossary/indirect-prompt-injection/ risks highlighted by SalesBleed https://forkast.news/salesforce-agentforce-got-zero-clicked-through-its-own-web-form-and-the-attack-vector-is-in-every-agent-that-combines-these-three-things/ and the misuse of agents against government infrastructure https://forkast.news/openai-agents-probed-us-government-sites-using-offensive-hacking-techniques/ , the default permissions of agent frameworks are becoming a primary attack surface. Defenders must move away from simple blocklisting. Blocking the Hermes Agent framework would disrupt legitimate users, as the framework itself is benign — with 249,000 GitHub stars and 53,000 forks, it has a substantial legitimate user base. Instead, security teams should hunt for specific abuse signatures: a /root/.hermes/SOUL.md file containing the string GH0ST, a .env file carrying CARBONATO API KEY, or unexplained outbound traffic to Telegram from server workloads. Most known CARBONATO infrastructure remained live as of September 3, 2026, including six of seven registries, phishing sites, a CDN, and the operation’s LLM gateway. The emergence of CARBONATO demonstrates that autonomous agents can be effectively weaponized to automate multi-stage operations, reducing the manual effort required for exploitation. As detailed in the Anthropic Misuse Report https://forkast.news/anthropics-misuse-report-seven-labs-190-million-exchanges-and-the-collapse-of-the-offensive-labor-gap/ , the integration of reasoning capabilities into malicious infrastructure represents a significant evolution in threat actor methodology. Attribution analysis by ThreatDown suggests the operators are likely based in Costa Rica, supported by four independent signals: 14 of 162 image configurations using UTC-06:00 timestamps matching the America/Costa Rica timezone, the Telegram handle Carbo506 with +506 as Costa Rica’s country calling code , reverse SSH tunnels terminating in AS262145 a Costa Rican network , and deployment reports written in voseo Spanish. For enterprise security teams, the challenge is no longer just identifying malicious binaries, but monitoring the intent and behavior of agents operating within their infrastructure.