Carbonato botnet uses AI agent as command-and-control engine

By Splitfeed EditorialLast updated Sep 28, 2026, 20:50 UTC

On September 27 and 28, 2026, security researchers publicly disclosed a botnet called Carbonato, identifying it as the first known botnet to use an AI agent as its command-and-control engine. According to the reporting, the botnet had already been running since October 2024, meaning it operated undetected for close to two years before disclosure. Its targets are hacked Docker hosts, placing cloud-native and containerized infrastructure at the center of its attack surface.

The significance here is architectural rather than incidental. Previous documented cases of AI in malicious contexts have treated it as a supplementary tool, something used to draft phishing text or accelerate reconnaissance. Carbonato is different because the AI agent is the operational core, the component that issues instructions and presumably adapts its behavior, rather than a feature bolted on to a conventional botnet. The fact that it ran undetected for nearly two years raises serious questions about whether existing detection frameworks are built to recognize AI-driven command-and-control patterns, and whether Docker environments in particular were screened for this kind of embedded agent activity.

No published reactions from any of the three camps have emerged yet. The Pro-AI camp would typically be cautious here, likely arguing that the underlying capability is not inherently tied to AI and that defenders can use the same tools to counter threats like this. The Anti-AI camp would typically treat Carbonato as a concrete example of the dangers of increasingly capable and accessible AI systems, pointing to the stealth and adaptability an AI-driven core provides as evidence that the technology lowers the floor for sophisticated attacks. The Middle Ground camp would typically call for updated threat modeling and detection standards without framing the story as a referendum on AI development broadly.

The details that would most sharpen this debate are still outstanding: the identity or affiliation of the operators, a technical breakdown of how the AI agent makes decisions, and whether any cloud providers or container security vendors have issued specific mitigations in response to the disclosure.