Checked fact 18428 Sep 2026Research

The botnet installs Hermes Agent, an MIT-licensed open-source framework from Nous Research, unmodified, then overwrites its persona file with instructions to maintain persistence and respond to Telegram commands.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

installs Hermes Agent, an MIT-licensed, open-source framework from Nous Research ... overwrites the agent’s SOUL.md persona file with the crew’s 39-line prompt. The framework already accepts Telegram tasks

What the source said when we opened it, on 28 Sep 2026.

The source

CARBONATO: a botnet built around an AI agent
ThreatDown (Malwarebytes) · 2026-09-22

Open the source archived copy

Checked

Checked by the notis newsroom on 28 Sep 2026, against the source above.

In the story

ThreatDown says the CARBONATO botnet installs an unmodified Hermes Agent and targets AI API keys first. 28 Sep 2026

Cite this fact

Short permanent address

In a sentence

“The botnet installs Hermes Agent, an MIT-licensed open-source framework from Nous Research, unmodified, then overwrites its persona file with instructions to maintain persistence and respond to Telegram commands.” ai notis, checked 28 Sep 2026. Source: CARBONATO: a botnet built around an AI agent (ThreatDown (Malwarebytes)). https://ainotis.com/c/184

As a reference (APA style)

ai notis. (2026, September 28). The botnet installs Hermes Agent, an MIT-licensed open-source framework from Nous Research, unmodified, then overwrites its persona file with instructions to maintain persistence and respond to Telegram commands [Checked claim 184]. ai notis. https://ainotis.com/c/184

Anyone may quote this address. It does not change; if we correct the story, this page says so.