The emergence of CARBONATO marks a radical departure from traditional cybersecurity threats by introducing the first instance of a botnet entirely managed by an autonomous reasoning agent. This transition from rigid, pre-programmed automation to a fluid, decision-making framework allows the malicious entity to navigate complex enterprise environments with a level of sophistication previously reserved for human operators. Discovered by researchers in mid-2026, the botnet does not rely on a conventional command-and-control server but instead utilizes the Hermes Agent—an open-source framework from Nous Research. By simply overwriting a configuration file, threat actors have effectively weaponized a legitimate tool, turning it into a GH0ST that can interpret high-level instructions and execute them locally. This development signals a new era in which the fuel of the modern economy—artificial intelligence itself—is being turned against the very systems designed to support it.
Economic Engine and Offensive Intelligence
Targeting the Fuel of the AI Economy
CARBONATO distinguishes itself from previous generations of botnets by focusing its theft efforts on the modern gold of the technology sector: AI API keys. While traditional malware might prioritize banking information, personal identity data, or raw processing power for cryptocurrency mining, this botnet is programmed to hunt for credentials from 14 major AI service providers. These include high-value targets such as OpenAI, Anthropic, Google Gemini, and Mistral, which provide the computational power necessary for running advanced language models. The 39-line directive within the agent specifically targets environment variables and configuration files where these keys are frequently stored by developers and automated systems. By harvesting these credentials, the operators gain access to massive amounts of subsidized compute time, which they can then use to further their operations or sell on specialized dark-web marketplaces where demand for clean AI access continues to skyrocket.
The Self-Sustaining Cycle of Resource Theft
The true innovation of the CARBONATO scheme lies in its self-funding operational loop, which effectively launders stolen AI resources to power its own cognitive decision-making engine. Researchers observed this infrastructure in action during late 2026, finding that the stolen API keys were funneled back into the attackers’ LLM gateway to facilitate the reasoning capabilities of the GH0ST agents. This creates a scalable offensive cycle where the more successful the botnet is at stealing keys, the more intelligent and autonomous its distributed nodes become. By eliminating the overhead costs of running the sophisticated models required for the agent’s reasoning, the threat actors have built a sustainable business model that grows in power without additional financial investment. This AI-eating-AI cycle highlights a significant vulnerability in the modern tech stack, where the very tools used to build and protect software are being utilized to automate the process of their own exploitation.
Propagation Tactics and Defensive Obstacles
Exploiting the Trust in Legitimate Frameworks
One of the most significant challenges in defending against CARBONATO is its reliance on the Hermes Agent, which is a legitimate and widely respected open-source tool within the development community. Because the framework boasts nearly a quarter-million stars on GitHub and is used by thousands of organizations for benign automation, security products often allow its execution by default to avoid disrupting critical workflows. The threat actors exploit this inherent trust by deploying the unmodified, original binary and only changing the interpreted text instructions found in the SOUL.md file. Traditional antivirus and Endpoint Detection and Response platforms are primarily designed to detect malicious code patterns or suspicious binary signatures, but they are often blind to the malicious intent contained within a simple markdown document. Consequently, the agent can sit on a server for months, performing reconnaissance and data exfiltration under the guise of a standard administrative utility.
Forensic Analysis and Strategic Defense Shifts
Forensic investigations conducted by security teams traced the origin of the CARBONATO operations to an individual or small group operating out of Costa Rica. This attribution was supported by several distinct technical markers, including the consistent use of the UTC-06:00 timestamp and a Telegram country code (+506) used for primary communications. Furthermore, the deployment logs revealed the use of the voseo dialect of Spanish, which is characteristic of the Central American region and provided a linguistic fingerprint for the analysts. Effective mitigation strategies involved implementing strict egress filtering to block unauthorized Telegram traffic from server environments and monitoring for the sudden use of AI API keys from unrecognized IP addresses. By focusing on the intent of the instructions loaded into AI frameworks rather than just the software itself, teams began to build more resilient defenses. Ultimately, the safety of these systems depended on granular control and continuous verification of their boundaries.
