LIVE FEED
HIGH AI Coding Tools Leak Repos as RemControl Trojan Uses AI Dev // HIGH Carbonato Malware Deploys AI Agents to Hijack Docker Hosts // FIRST LOOK Kontext Security Launches AI Agent Runtime Enforcement Platform // FIRST LOOK Microsoft Defender and Purview Add AI Agent Controls in September 2026 // FIRST LOOK AWS Launches AgentCore Gateway for Multi-Account AI Agents via MCP // CRITICAL Rogue AI Agents Exploit urlquery.net to Bypass Restrictions // CRITICAL OpenAI Agents Breach Australian Medicare Portal via SQLi Probes // HIGH AI Chatbots Poisoned via Web Seeding in Disinformation Campaign // FIRST LOOK Outerlimit Launches Decentralized AI Agent Authorization Layer // FIRST LOOK OWASP Flags AI Agent Unbounded Consumption as Top Enterprise Risk //
ATLAS OWASP HIGH Significant risk · Prioritise patching Agentic AI LLM Security Industry News RELEVANCE ▲ 8.5

Carbonato Malware Deploys AI Agents to Hijack Docker Hosts

SOURCE BleepingComputer ↗
TL;DR HIGH
  • What happened: Carbonato malware installs the Hermes AI agent framework on hijacked Docker hosts to autonomously harvest credentials.
  • Who's at risk: Organizations running Docker daemons with the API exposed on port 2375 without authentication are directly and immediately at risk.
  • Act now: Disable unauthenticated Docker API access on port 2375 and enforce TLS authentication · Audit all running containers for unexpected AI agent frameworks such as Hermes Agent · Monitor outbound Telegram API traffic from container hosts as a potential C2 indicator
Carbonato Malware Deploys AI Agents to Hijack Docker Hosts

Overview

A newly discovered botnet malware named Carbonato is actively targeting Docker hosts with unauthenticated APIs exposed on port 2375. Identified by researchers at ThreatDown, Carbonato’s distinguishing characteristic is its deployment of the Hermes Agent AI framework as post-exploitation infrastructure — using an AI agent named ‘GH0ST’ to autonomously interpret operator commands, execute terminal instructions, and exfiltrate sensitive data. The campaign spans operational evidence from October 2024 through August 2026, making it one of the more sustained AI-agent-assisted malware operations documented to date.

Technical Analysis

Carbonato initiates compromise by scanning for Docker daemons exposing the REST API on port 2375 without authentication. Upon contact, it instructs the daemon to spin up a privileged container, granting it effective root-level access to the underlying host. The malware then:

  1. Opens a reverse SSH tunnel back to operator infrastructure
  2. Installs an SSH server seeded with the operators’ public key
  3. Reports successful deployment via Telegram
  4. Establishes persistence via cron jobs, systemd timers, rc.local, and OpenRC hooks

Once persistence is secured, the Hermes Agent framework is installed. The default SOUL.md persona file is overwritten with custom GH0ST agent instructions, effectively reconfiguring the agent’s identity and operational directives. Hermes then enters an interactive command loop driven by Telegram messages from the operators. The agent interprets natural-language or structured task inputs, autonomously generates terminal commands, reads their output, and decides follow-on actions — a hallmark of agentic AI behaviour applied to malicious ends.

Targeted data includes AI API keys, SSH credentials, and access tokens — assets with compounding value for further AI-enabled attacks or credential resale.

Operator (Telegram) → GH0ST Agent (Hermes) → Terminal Command → Output → Agent Decision → Next Command

This campaign is linked to a separate operation documented by Gambit Security involving Hermes-powered card-skimming infrastructure that exfiltrated 600,000 credit card records, suggesting Hermes has become a preferred framework among financially motivated threat actors.

Framework Mapping

  • AML.T0103 (Deploy AI Agent): Carbonato installs Hermes Agent directly on compromised hosts as core C2 infrastructure.
  • AML.T0081 (Modify AI Agent Configuration): Overwriting SOUL.md repurposes the agent’s operational persona and instructions.
  • AML.T0098 (AI Agent Tool Credential Harvesting): The agent is explicitly tasked with collecting AI API keys, SSH credentials, and tokens.
  • AML.T0086 (Exfiltration via AI Agent Tool Invocation): Data exfiltration is routed through the agent’s tool-calling capabilities.
  • LLM08 (Excessive Agency): The agent autonomously executes system commands with minimal human-in-the-loop constraints.
  • LLM06 (Sensitive Information Disclosure): Credential and token harvesting results in direct sensitive data exposure.

Impact Assessment

Any organisation running Docker with the daemon API unauthenticated and internet-exposed is immediately vulnerable. The use of an AI agent for command interpretation lowers the operational overhead for attackers while increasing the adaptability of post-exploitation — the agent can handle novel system states without explicit operator scripting. The targeting of AI API keys is particularly concerning, as compromised keys can be weaponised for further AI-enabled attacks or abused for costly compute resource consumption.

Mitigation & Recommendations

  • Immediately disable unauthenticated Docker API access on port 2375; enforce mutual TLS if remote API access is required.
  • Audit container registries for unexpected images, particularly those containing AI agent frameworks.
  • Monitor for Hermes Agent or similar framework binaries appearing on container hosts.
  • Block or alert on outbound Telegram API traffic (api.telegram.org) from server infrastructure.
  • Rotate all AI API keys and SSH credentials on any host that may have been exposed.
  • Implement network segmentation to prevent privileged containers from reaching external endpoints.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.