Checked fact 18528 Sep 2026Research

The persona file directs the agent to prioritize stealing AI API keys from 14 providers ahead of SSH credentials, access tokens and databases.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

AI API keys are the absolute priority ... OpenAI, Anthropic, Google, Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, One API

What the source said when we opened it, on 28 Sep 2026.

The source

CARBONATO: a botnet built around an AI agent
ThreatDown (Malwarebytes) · 2026-09-22

Open the source archived copy

Checked

Checked by the notis newsroom on 28 Sep 2026, against the source above.

In the story

ThreatDown says the CARBONATO botnet installs an unmodified Hermes Agent and targets AI API keys first. 28 Sep 2026

Cite this fact

Short permanent address

In a sentence

“The persona file directs the agent to prioritize stealing AI API keys from 14 providers ahead of SSH credentials, access tokens and databases.” ai notis, checked 28 Sep 2026. Source: CARBONATO: a botnet built around an AI agent (ThreatDown (Malwarebytes)). https://ainotis.com/c/185

As a reference (APA style)

ai notis. (2026, September 28). The persona file directs the agent to prioritize stealing AI API keys from 14 providers ahead of SSH credentials, access tokens and databases [Checked claim 185]. ai notis. https://ainotis.com/c/185

Anyone may quote this address. It does not change; if we correct the story, this page says so.