Back Securityaffairs.Co

TuxBot v3: The IoT Botnet Built With AI – Bugs, Disclaimers and All

Securityaffairs.Co •Pierluigi Paganini • July 16, 2026

TuxBot v3, an AI-built IoT botnet for 17 architectures, shipped with LLM bugs and safety disclaimers the developer never removed. Palo Alto Networks’ Unit 42 identified a previously undocumented modular IoT botnet framework called TuxBot v3 Evolution, and it comes with an unusual detail: the developer used a large language model to write significant portions […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TuxBot v3 Evolution: New Modular IoT Botnet Leveraging LLM Technology The TuxBot v3 Evolution is a newly discovered IoT botnet framework that targets a wide range of internet-connected devices, including ARM, MIPS, x86_64, PowerPC, and RISC-V architectures. It is designed for mass compromise and distributed denial-of-service (DDoS) operations, utilizing a C-based bot agent and a Go-based command-and-control server. The botnet is notable for using large language model (LLM) technology to generate its code, which has led to the inclusion of bugs and safety disclaimers in the software. Palo Alto Networks' Unit 42 has identified this modular framework, which poses a significant risk to routers, cameras, and other Linux-based devices. The botnet's ability to exploit various architectures increases the scope of its impact, potentially affecting millions of devices globally. Security professionals are urged to monitor their systems for signs of compromise and to implement defensive measures against this evolving threat. 5 sources 68

TuxBot v3: The IoT Botnet Built With AI – Bugs, Disclaimers and All

The full story

Extracted Entities

Attack Types (1)

Malware (2)