A Botnet Author Asked an AI for Malware. The AI Left the Warning Label On.

Key points

• Researchers disclosed TuxBot v3 Evolution, a botnet that hijacks internet-connected devices such as routers and cameras to attack other systems.
• The code carries hallmarks of AI assistance, specifically a large language model of the kind that powers ChatGPT.
• The developer didn't remove the AI's own safety disclaimer, leaving it embedded in the malware's source.
• Targets are IoT (Internet of Things) devices: everyday gadgets like home routers and smart cameras, often running forgotten factory-default passwords.
• The find suggests low-skill criminals can now bootstrap working malware they couldn't write alone.

Someone tried to build a botnet with a chatbot's help and forgot to delete the fine print.

Security researchers have gone public with TuxBot v3 Evolution, a botnet that conscripts internet-connected home devices into a remotely controlled network used to launch attacks or relay criminal traffic. It targets cheap IoT gear: Wi-Fi routers, security cameras, the boxes sitting in homes and small offices that nobody updates.

What makes it interesting isn't the code quality. It's the fingerprints.

Whoever wrote TuxBot leaned on a large language model, the sort of AI assistant millions of people use to write emails and code. The giveaway was hiding in plain sight: the AI's safety warning sat untouched in the source. The chatbot produced the requested botnet code, appended a disclaimer saying the output was for educational purposes only, and the developer pasted the whole thing into the project without noticing. As The Hacker News first reported, the AI complied with the request but flagged its own output. The human on the other end wasn't paying attention.

We've been tracking this pattern: our 13 July report on an attacker using AI-written PowerShell to map a corporate network showed the same fingerprint of machine-generated code run by someone who didn't fully understand it.

Does this mean AI is now writing real malware?

Sort of, but not the way the headlines suggest. The AI didn't refuse. It also didn't produce anything impressive. By the researchers' account TuxBot isn't especially effective: it works, but it's clumsy, and the embedded disclaimer tells you the author can't read their own code well enough to spot an obvious paragraph of English sitting in it.

That's the real story. Not that AI has unlocked elite hacking. That it's lowered the floor.

People who couldn't write a working botnet from scratch can now assemble one by asking nicely. The output is buggy and the author likely doesn't fully grasp it. But it runs, scans the internet for vulnerable devices, and enrolls them into a network that can be aimed at a target.

What does it actually do?

TuxBot v3 Evolution behaves like most IoT botnets. It hunts for internet-connected devices running weak or default passwords, or carrying known unpatched flaws, breaks in, plants itself, and calls home to a controller. From there the collective can flood a website with junk traffic (a denial-of-service attack) or serve as cover for other criminal activity.

The targets are almost always devices their owners have forgotten. A router installed six years ago. A camera bought on a marketplace with a factory password nobody ever changed.

What should ordinary people do?

If you own a home router, a smart camera, or a network-attached storage box, do two things. Change the default admin password to something long and unique. Check the manufacturer's app or support page for a firmware update, which is how vendors patch known security holes.

Devices more than five or six years old that no longer receive manufacturer updates are quietly rotting on your network. Replace them when you can.

The researchers haven't named the group behind TuxBot, and attribution on IoT botnets is slippery: code gets copied and rebranded within weeks. Expect variants. The next author may remember to delete the disclaimer.