I keep my production infrastructure boring on purpose. Boring is auditable. Boring is survivable. So when I read last week that a piece of malware called CARBONATO had repurposed a perfectly legal open-source AI agent framework into a command-and-control engine, I did not read it as a news item. I read it as an audit checklist, and I walked to my laptop at 2 a.m. to open every configuration file in my own trading stack.
The thing that kept me awake was not the intrusion vector. It was the payload. CARBONATO's command engine is not a binary. It is a 39-line prompt written into a file called SOUL.md.
Based on my audit experience, the most dangerous line in any codebase is never the exploit(). It is the line that looks like configuration. Every disaster I have survived started as something that looked reasonable in a config file.
What CARBONATO actually is
The report โ sourced from a single threat-intelligence vendor, ThreatDown, and describing events it timestamps to August and September of 2026 โ describes a piece of malware that uses Nous Research's Hermes Agent as its implant. Hermes is MIT-licensed, legitimate, and built for autonomy: it can execute shell commands, reach the network, and read and write files. CARBONATO's operators did not modify a single byte of its code. They overwrote one file โ Hermes's personality definition, SOUL.md โ and redirected the agent's entire behavior toward intrusion.
That is the whole trick. Rename the process to GH0ST. Add persistence instructions. Teach it to answer Telegram commands. Set a credential-harvest priority order. And then let the agent run its normal reasoning-and-execution loop, except now the loop's goal has quietly flipped from completing a task to owning a machine.
Before I go further, I owe you the boundaries of what I can and cannot vouch for. The core events are dated to a window beyond what I can independently verify, and I am not backing their authenticity. The source is a single vendor with an obvious interest in demonstrating detection capability. One metric in the report โ a claim that Hermes Agent carries 249,000 GitHub stars and 53,000 forks โ is off by at least an order of magnitude against any mainstream agent framework I know, which means either the report conflated projects, inflated a number, or made an error. So treat everything downstream of that Telegram control channel as a claim, not a verifiable record. What I care about is the mechanism, because the mechanism is internally consistent and reproducible regardless of whether this particular incident happened exactly as written.
If you trade with agents โ and if you run a copy-trading platform like mine, you trade with agents every single block โ you are already inside this story. You just have not met the villain yet.
The decoupling that matters
Here is the part the headlines buried. CARBONATO's genuine technical innovation is not that it uses an AI. It is the decoupling of attack logic from attack payload. The command-and-control layer no longer depends on a static executable. It depends on loaded instructions. The operator ships intent, not code, and the agent compiles that intent into action at runtime.
That is an application-level recombination, not an architectural breakthrough. It uses off-the-shelf tooling plus a general-purpose model. But low barriers and easy copying are precisely what make security implications worse, not better. A novel exploit that requires a PhD is a controlled burn. A copyable recipe that requires a weekend is a wildfire.
The control flow is a textbook ReAct loop โ reason, act, observe โ running in reverse of its purpose. Telegram carries the order. The agent, carrying its infected SOUL.md, forwards it to a model gateway. The gateway returns commands. The agent interprets the output, then decides the next step. This is the same loop that powers every agent-driven trading bot I have ever deployed, only pointed at your infrastructure instead of your order book.
Now here is the cooling detail, and I want to give it more weight than the report did: the propagation is not AI at all. Whoever is behind this scans Docker port 2375 every five minutes. That is a scanning behavior indistinguishable from what scripted attackers were doing a decade ago. AI covers only the post-exploitation phase. This is not a fully automated artificial hacker. It is an old break-in with an unnervingly modern brain bolted on afterward.
That distinction is the difference between a viral legend and an engineering fact. And engineering facts are the only thing I can act on.
The structural flaw hiding under the name
SOUL.md is Hermes's personality file. Overwriting it is functionally identical to system-prompt injection via file write. The attacker does not need a memory-corruption bug or a privilege escalation. They need write access to a file that the framework trusts implicitly and never validates for integrity.
This is not a Hermes problem. This is a generalizable structural defect across any agent framework that loads its system instructions from the filesystem without verification โ and that is most of them. Once you understand the pattern, you start seeing it everywhere. The persona file sits in the same writable namespace as the logs. The system instruction is not isolated from externally writable regions. Nothing separates the agent's identity from its attack surface.
I learned this lesson the hard way in 2017, watching the Parity multi-sig wallet bleed 150,000 ETH while my own 40 ETH hung in the balance. I spent two weeks reverse-engineering the call-dependency vulnerability in the EVM, and what I took away was not fear of smart contracts. It was the conviction that trust must be verified at the execution path, not assumed at the interface. Nine years later, the same principle is staring back at me in an agent's persona file. The SOUL.md here is another Parity โ a dependency no one questioned until it was loaded with a weapon.
The gateway design exposes something else worth respecting, even as you defend against it. The operators did not hard-wire a single model. They built an abstraction layer that is deliberately model-agnostic and key-pooled, so they can rotate stolen credentials, spread their activity across providers to dodge risk controls, and swap inference backends at will. That is an enterprise-architecture pattern โ graceful failover, provider abstraction, key rotation โ lifted directly into criminal infrastructure. Whoever built this understood distributed-systems hygiene.
And the fact that they modified zero bytes of the binary is a double signal. It is a detection-evasion choice, certainly. Static analysis has nothing to flag when the malicious logic lives in a text file that the framework reads as legitimate. But it may also be a message aimed at defenders: we are using your own tools against you, and you cannot prove we changed a thing.
Parasitic compute: the real asset being stolen
The economics of CARBONATO are what turn a curiosity into a business model. Nobody is buying GPU clusters. The operators steal LLM API keys and ride the inference capacity of fourteen separate providers. An API key is a compute credential. Possessing one is equivalent to possessing a voucher for someone else's model, redeemable on demand, hard to trace, and consumable in controlled amounts.
That reframing matters more than any single intrusion. Look at the priority order the malware encoded: AI credentials ranked above SSH keys and above database credentials. In the attacker's value function, a live model API key is the best immediate prize. It is usable the second it is taken, its abuse is difficult to attribute, and its consumption can be throttled to blend into normal traffic. That is a market repricing of digital assets, and it is the single most useful piece of intelligence in the entire report โ not because of what it says about the attacker, but because of what it says about where value now sits. If criminals rank your model access above your server access, your security budget is probably ranked backward.
The gateway then redistributes that stolen capacity. Twelve paid tiers, twenty-seven free tiers. The free layer is almost certainly a combination of customer acquisition, load testing, and downstream distribution โ a way to launder stolen inference through a quasi-secondary market that degrades the traceable value of any single credential. Liquidity is just trust, digitized and leveraged. Here the trust being leveraged is a provider's, and the leverage is a stolen key.
The most dangerous target in the list is the one that gets the least attention: Ollama, vLLM, and LocalAI. A stolen commercial API key can be revoked. A compromised local inference endpoint is offline compute that never trips a provider's risk controls, because there is no provider. That is the theft type I would fear most if I were running security for a fund whose models sit on private hardware.
Why detection broke, and where it has to go
The report is explicit and correct on one structural point: the malicious behavior is driven by instructions rather than a binary, so there is no static signature to catch. This directly assaults the core assumption of every EDR and antivirus product whose business rests on file characteristics and static indicators of compromise. When the payload is a prompt, the signature file is empty.
And you cannot simply blacklist the framework. Hermes is legitimate. Banning it would penalize a vast population of lawful users โ the report cites that inflated star count precisely to illustrate how large that population is. Signature-based banning is not viable in an open-source agent ecosystem. The tool is dual-use by nature, and dual-use is the open-source bargain that no compliance framework has yet learned to price.
So defense retreats to hand-crafted Indicators of Intent. The current detection points are a SOUL.md under /root/.hermes containing the string GH0ST, a .env file containing CARBONATO_API_KEY, and anomalous outbound Telegram traffic. These are not signatures in the classical sense. They are intent indicators, distilled case by case by researchers. They do not scale automatically. Their very existence tells you the defensive side has not yet built the capability to generalize, and that is the most honest line in the whole document.
There is a sick irony underneath all of this: the entry point is Docker port 2375, a misconfiguration old enough to have grandchildren. We are not watching a genius invent a new door. We are watching an old, forgotten door get kicked in by something that finally learned to think about what it was doing inside.
The attacker's economy has a fatal seam
I want to spend real time on the failure modes nobody wants to discuss, because a threat model that only describes the attacker's strengths is propaganda, not analysis.
The parasitic compute model is entirely dependent on the continued life of stolen keys. If the fourteen providers move to batch-revoke compromised credentials and tighten anomaly detection on call patterns, the closed loop snaps shut. There is no discussion in the report of an automatic key-rotation mechanism โ a stolen-key marketplace that survives revocation. Without one, the operation decays the moment providers respond, and provider response is the highest-leverage counterstrike available. This is the equivalent of an arbitrage that only works while the inefficiency persists, and inefficiencies get corrected.
Then there is the variable the report treats as pure upside and that I treat as a two-edged blade: the model's non-determinism. Every page praises the agent's adaptive, unpredictable reasoning as an attack strength. But non-determinism does not care whose side you are on. An agent running with shell access can hallucinate its way into deleting its own config, exposing its own presence, or issuing a self-destructive command. The same property that makes it hard to fingerprint makes it hard to control. The report shapes uncertainty as an attacker advantage and quietly omits that it is simultaneously the attacker's most unstable internal component.
The propagation layer is another seam. Docker 2375 scanning is laughably detectable โ it is a fixed, well-known behavior against a port that should have been closed years ago. Any organization that actually hardened its container daemon has already neutralized the entire entry chain. The brain is modern. The hands are antiques. And antiquated hands are the ones defenders can still cut off.
The contrarian read: this is a forecast, not an apocalypse
Here is where I part ways with the narrative. The report's language is studded with novelty premiums โ "first," "major evolution," "sustainable offensive model." I want to dismantle each.
"First ever agent as a C2 engine" depends entirely on how you define an autonomous C2. We have had LLM-assisted criminal tooling for years. We have had agent-malware proofs of concept. The claim to primacy lives or dies on a definitional boundary the report never draws, which means the primacy claim is softer than it sounds. Novelty language sells research. It does not necessarily describe reality.
"Sustainable offensive model" ignores the revocation dependency I just described. A model whose floor is one provider crackdown away from collapse is not sustainable. It is opportunistic.
The behavioral profile confirms this. Trace the operational security and you find jarring contradictions. The C2 runs over Telegram โ plaintext command relay that is trivially detectable by TLS fingerprinting and traffic-pattern analysis. That is a low-tech choice bolted onto a high-tech core. The attribution signals the report gathers โ a timezone of UTC-06:00, an account name referencing Carbo506, an autonomous system ending in AS262145, and voseo Spanish โ converge on a single geography, but at uneven strength. The account name and the SSH tunnel endpoint are relatively strong. The timezone timestamp is moderate. The voseo dialect is weak, because that grammatical form is common across multiple Central American countries and is not unique to the one the report names. At least two of four attribution signals are soft. The honest reading is medium-confidence attribution at best, and regional blocking is a defense with near-zero value anyway, because infrastructure migrates in an afternoon.
What emerges is not a sophisticated APT. It is an opportunistic individual or micro-team that grabbed the newest tool and paired it with the oldest tactics. The report praises the attacker's intelligence at length while saying almost nothing about the most important fact: the danger is not that the attacker is brilliant. The danger is that the recipe is copyable. The moat is nearly zero โ open-source framework, general-purpose model, known vulnerability. The most advanced agent C2 anyone has documented runs alongside a decade-old port scan and a plaintext chat channel. That split personality is not a signature of mastery. It is a signature of someone who found a sharp new knife and has not yet learned to handle it safely.
And the real ethical question the report mostly skips is not about the attacker at all. It is about framework responsibility. Agent frameworks ship with an oversized default permission surface and no write protection on their system-instruction files. An agent that can execute shell plus reach the network is a latent bot by default, and its persona file sits in a writable region with no integrity check. The people who design these frameworks owe the ecosystem defaults that respect how easily identity files can be hijacked. Silence on this is not neutrality. It is abdication.
The signal levels worth watching
I trade by levels, not by opinions, so let me give you the equivalents here โ the concrete telemetry bands where the story resolves.
Watch whether Hermes's star and fork counts check out against the official repository. If the report's numbers are fabricated, its research quality is in question, and every downstream claim drops a tier. Watch whether any independent research group reproduces the case. That single event is the hinge on which the "first ever" claim swings โ corroborated, and overall confidence rises; silent for months, and single-source false-positive becomes a live possibility. Watch for a second agent-C2 botnet family. One is an anecdote. Two is a trend.
On the defensive clock, the near-term question is whether the fourteen providers move publicly โ revoking keys, tightening call-pattern anomaly detection. The mid-term question, three to twelve months, is whether mainstream agent frameworks ship default sandboxing, least-privilege permissions, and write protection on system-instruction files. That transition โ from lesson to engineering fix โ is the real indicator that the industry has absorbed the point rather than just written a report about it.
And on my own desk, the lesson has already landed. I spent years building Human-in-the-Loop circuit breakers into my copy-trading platform because I learned during a flash crash that my team's AI would not pause trading on its own โ my manual override saved 15 percent of community funds that day. CARBONATO is the same lesson wearing a different mask. The permission surface you give an agent is the blast radius you accept when its identity file is compromised. We traded hope for efficiency, and what came back was a liability we never itemized.
So close the daemon. Version the persona file and alert on any write to it. Treat every LLM API key as a compute credential โ least privilege, call-pattern monitoring, instant revocation. And build intent detection that watches what a running agent does, not what a file claims it is. Because the next CARBONATO will not need a 39-line prompt. Somebody bored on a weekend will do it in nine.