The file was thirty-nine lines long. That is the entire weapon — not a binary, not a kernel exploit, not a memory-corruption gadget chained across a decade of disclosed vulnerabilities. Thirty-nine lines of natural language, written into a personality definition file on a machine nobody was watching, and a legitimate open-source agent framework woke the next morning as an intrusion toolkit. I keep returning to that number. Thirty-nine. In roughly the time it takes to skim a terms-of-service agreement, someone converted a tool built to be helpful into an instrument of harm, and the security industry's foundational assumption — that malicious intent must be encoded in something you can scan — quietly expired. Not with a bang. With a markdown file.
I have spent nineteen years watching systems fail, and the failures that actually matter are rarely the loud ones. They are the failures where the architecture performed exactly as designed, and the design was the problem. This is one of those.
The Case, and Its Limits
Before the analysis, the boundary conditions — because a structural argument built on a single source is itself a fragile structure. What follows rests on a report attributed to ThreatDown, describing a threat actor dubbed CARBONATO, with core events timestamped to roughly August and September of 2026. That window sits beyond what I can independently verify. I am not endorsing the facts. I am examining whether the technical logic holds together, because a claim can be unverified and still be instructive — and this one, if even half-true, tells us something urgent about the coming collision between autonomous agents and the assets we are about to hand them.
The mechanism, as described: an attacker scans for Docker daemons listening on port 2375 — the unauthenticated API socket that has been a documented catastrophe since roughly 2016 — deploys a downloaded implant, and overwrites a single file called SOUL.md inside the Nous Research Hermes Agent, an MIT-licensed framework. That file governs the agent's persona. By rewriting it, the attacker redirects the agent's entire behavior: persistent execution, a rename to a process masquerading as a system component, a Telegram bot as command-and-control, and a credential-collection routine that prioritizes one asset class above all others — LLM API keys. Not SSH keys. Not database passwords. API keys for large language models, harvested across fourteen providers, then pooled behind an attacker-operated gateway offering twelve paid model tiers and twenty-seven free ones. The target list, tellingly, also includes local inference endpoints — Ollama, vLLM, LocalAI.
Attribution signals converge, weakly, on Costa Rica: a UTC-06:00 timezone on the container images, an account handle referencing the +506 dialing code, a terminating autonomous-system number, and Spanish-language text exhibiting voseo. We will return to why at least two of those four signals are soft. First, the structure.
The Decoupling That Changes Everything
The genuine innovation here is not intelligence. It is separation. CARBONATO decouples attack logic from attack payload. Historically, command-and-control required a static binary — a compiled implant with hardcoded server addresses, fingerprintable strings, and file hashes that defenders could blacklist within hours. Here, the C2 no longer lives in code. It lives in the instructions the agent loads. The malicious 'intent' has migrated out of the binary and into plain text, and plain text — particularly text that reads as legitimate configuration — has no signature to match.
This is why the framing matters. Consider what the attacker actually reused. A standard ReAct reasoning loop — the observe-think-act cycle every agent framework implements — was bent toward a new goal. Telegram message arrives; agent carrying the poisoned persona forwards it to an LLM gateway; the gateway generates a shell command; the agent executes and interprets the output; the cycle repeats. Textbook agent architecture. The only substitution is the objective: from complete my task to automate this intrusion. Nothing new was built. Everything was rearranged.
And it was arranged cheaply. The thirty-nine lines handle four jobs: rename the implant to evade casual audit, establish persistence, wire the Telegram command surface, and rank credential priorities. That economy is the story. When a system prompt is sufficient to redirect an entire agent's behavior, prompt engineering becomes weapons engineering — and the barrier to entry collapses to the ability to write coherent instructions.
Permission Surfaces: The Lesson Crypto Already Learned
Here is where my own audit history refuses to stay quiet. In 2017, I spent six months dissecting Ethereum's early architecture and deployed a minimal DAO prototype with real capital behind it. It collapsed — not through exotic cryptography, but through a wallet contract whose privileged function was reachable by the wrong party. In 2020, modeling liquidity inside Aave v2, I found an under-collateralization seam and pulled exposure weeks before the anchor broke. Both experiences taught the same lesson, and it is the lesson CARBONATO now reinforces: the attack always travels through the permission surface, never through the intelligence of the attacker.
An agent that can execute shell commands, access the network, and read and write files is, by construction, a latent bot. The 'helpfulness' — the very capability that makes the framework valuable — is the exact capability the attacker monetizes. There is no exploit required. The agent is functioning correctly while it betrays you. This is structurally identical to a smart contract with an unguarded onlyOwner function: nothing is broken, and everything is at risk.
The second structural flaw is subtler. SOUL.md is a system-prompt file. Overwriting it is system-prompt injection carried out through the file system — the same class of vulnerability that researchers have demonstrated for years, now weaponized because the file was writable and unverified. Any framework that loads its system instructions from a mutable, unchecked location inherits this risk. This is not a Hermes defect. It is a category defect, and the industry has not internalized it.
I watched the same pattern in the NFT cycle I audited in 2021, where wash-trading algorithms manufactured scarcity while the community mistook the surface for substance. The chaotic surface of a market is not where the risk lives. The risk lives underneath — in the plumbing, in the defaults, in the unguarded function nobody reads.
Parasitic Compute and the Repricing of Digital Assets
Now the economics, because the economics reveal what the attacker actually values.
CARBONATO fields no GPU cluster. It steals access instead — fourteen providers' worth of API credentials, each one a key to someone else's inference capacity. An API key is now a compute credential, and its theft is a leveraged borrow against another party's balance sheet. The cost of running a botnet that reasons has dropped from 'build a data center' to 'harvest keys and route traffic.'
The priority ordering inside those thirty-nine lines is the most quotable intelligence in the entire report. LLM keys outrank SSH credentials and database passwords. That ordering is a market signal: the attacker has repriced digital assets and concluded that stolen inference capacity offers the best ratio of immediate utility to traceability. Keys are usable the instant they are lifted, difficult to attribute, and consumption can be throttled to stay under anomaly thresholds. That is a portfolio decision, and it should worry every infrastructure operator reading this.
The gateway design betrays genuine engineering maturity of a specific kind: a model-agnostic router rather than a direct connection to a single provider. That architecture enables key rotation, risk dispersal, and back-end substitution mid-operation. It is an enterprise pattern — the kind you would find inside a well-run platform team — transplanted wholesale into criminal infrastructure. If you want a working definition of 'industrialized misuse,' that is it.
And the twelve-plus-twenty-seven tier structure is not generosity. Free tiers do the work that free tiers always do: acquire downstream users, absorb load, and dissipate tracking. Stolen capacity re-enters circulation through a quasi-secondary market, diluting the forensic value of any single key.
Detection Is the Casualty
Strip away the narrative and the most consequential claim is methodological. The report states plainly that this behavior lacks interceptable static features because it is driven by instructions rather than binaries. That statement, taken seriously, is an indictment of an entire defensive paradigm. Endpoint detection has always leaned on artifacts — file hashes, byte patterns, behavioral signatures. Here there is nothing durable to match, and the one apparently obvious countermeasure — blacklisting the Hermes framework — is a self-inflicted wound, since banning a legitimate open-source project punishes its enormous community of benign users.
What is left? The recommended detections are hand-crafted: look for a SOUL.md containing a specific string, an environment file holding a specific key name, anomalous outbound traffic to Telegram. Those are indicators of intent, and they cannot yet scale. This is where the crypto ecosystem should pay attention, because DeFi spent 2022 learning the same lesson — that hardcoded blacklists and reactive patching do not survive an adversary who can compose freely from legitimate components.
The Contrarian Turn: This Is a Precedent, Not an Apocalypse
Now the destabilizing part, because the celebratory framing deserves resistance.
The report leans hard on novelty — 'first agent-as-C2,' 'sustained offensive model.' The word first is doing enormous rhetorical labor, and it is fragile. LLM-assisted criminal tooling — WormGPT, FraudGPT — predates this, and agent-driven malware proofs of concept have circulated for some time. Whether CARBONATO is genuinely first depends entirely on how one defines 'autonomous C2,' a boundary the report never sets. Novelty claims without defined edges are marketing, not analysis.
The threat-actor profile, meanwhile, contradicts its own hype. The advanced part is the agent orchestration. The primitive part is the entry vector: scanning an unauthenticated Docker port that should have been closed in 2016, paired with cleartext Telegram as command-and-control. That combination — state-of-the-art brain, decade-old hands — does not describe a mature APT. It describes an opportunist who grabbed a sharp new tool. The most sophisticated thing about this operation is how ordinary most of it is.
The attribution is softer than presented. The account handle and the autonomous-system endpoint carry some weight; the timezone is middling; and voseo — cited as a Costa Rican fingerprint — is a register used across multiple Central American nations. Two of four signals are weak, and geo-targeting infrastructure that can migrate in an afternoon is a defensive maneuver with almost no return. Chasing geography is a distraction from the structural problem.
Finally, the report underweights the adversary's own fragility. LLM non-determinism produces hallucinations; hallucinations inside an autonomous intrusion loop can trigger self-destruction, misconfiguration, or exposure. A system that reasons unpredictably is unstable for everyone, including the person who built it. And every claim originates from a single security vendor with a commercial interest in emphasizing novelty. The intelligence is useful. The framing is priced.
What Comes Next
The lesson is not that machines have learned to hack. They have not, in any meaningful sense. The lesson is that we have spent a decade embedding autonomous execution — agents that read, decide, and act — into infrastructure without ever securing the surfaces those agents stand on. The thirty-nine lines are almost beside the point. They worked because the ground beneath them was unguarded.
Which brings me to the question that should preoccupy anyone building in this space. Crypto is now racing to hand signing authority, treasury management, and on-chain execution to language models — agents that will hold keys, move funds, and act on macro signals. We are about to give reasoning systems the one capability every attacker in this report was hunting: permission to act. Before we do, someone must answer honestly whether a system instruction file can be overwritten, whether a credential can be exfiltrated, whether a helpful agent is just a patient adversary wearing a friendly name.
CARBONATO is not the end. It is the first line of a new argument. The question is whether we read it, or keep scanning for binaries that were never there.
