Reported by 9 outlets

Timeline

1. original reporting

   New Carbonato malware uses AI agents to hijack exposed Docker hosts https:// bleepingcomputer.com/news/security/ new-carbonato-malware-uses-

   www.bleepingcomputer.com · 19d ago · September 24th, 2026

   New Carbonato malware uses AI agents to hijack exposed Docker hosts https:// bleepingcomputer.com/news/security/ new-carbonato-malware-uses-

   via X https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/

2. update from threatdown.com

   CARBONATO: a botnet built around an AI agent

   threatdown.com · 22d ago · September 22nd, 2026

   ThreatDown researchers at Malwarebytes uncovered CARBONATO in August 2026 after finding an unauthenticated Docker registry exposed since May 2026 containing 59 repositories, 234 image tags, 605 verified blobs, and 4.3 GB of image data spanning October 2024 to August 2026. The botnet targets Docker daemons on port 2375 without authentication, launches privileged containers, installs persistence via cron and systemd timers, opens reverse SSH tunnels to a Costa Rican sink (AS262145), and deploys the Hermes Agent AI framework with a GH0ST persona file that directs credential theft prioritizing AI API keys. The blog documents the full kill chain including the interactive Telegram-controlled command loop, worm-like scanning of attached networks every five minutes, and the operation's LLM gateway that served 27 models.

3. update from malware.news

   CARBONATO: a botnet built around an AI agent

   malware.news · 20d ago · September 23rd, 2026

   Threat Intelligence , Threat Walkthroughs ​CARBONATO:​ ​a​ ​botnet​ ​built​ ​around an AI agent​ ​ThreatDown​ ​researchers​ ​uncovered​ ​CARBONATO,​ ​a​ ​Docker​ ​botnet​ ​built​ ​around​ ​an​ ​AI​ ​agent​ ​that​ ​compromises​ ​exposed​ ​Docker​ ​daemons,​ ​spreads​ ​across​ ​reachable​ ​hosts,​ ​and​ ​gives​ ​operators​ ​a​ ​Telegram-controlled​ ​tool​​ for​ ​post-compromise activity.​ September 22, 2026 ThreatDown Writer In August 2026, we found an unauthenticated Docker registry that had been publicly exposed since May. Over one day of passive, read-only collection, we recovered 59 repositories, 234 image tags, 605 verified blobs, and 4.3 GB of image data. The archive spans October 2024 through August 2026. It documents two linked product lines: a factory distributing trojanized cryptocurrency wallet apps, and a botnet that compromises Docker daemons exposed on port 2375. At the center of the botnet is Hermes Agent, an MIT-licensed open-source agent framework. The implant installs the framework unchanged, then overwrites its SOUL.md persona file. The 39-line prompt directs it to execute tasks received through Telegram, maintain persistence, and collect credentials. ​Finding​ ​Evidence​ ​An exposed r

4. update from bleepingcomputer.com

   Carbonato malware uses AI agents to hijack exposed Docker hosts

   bleepingcomputer.com · 19d ago · September 24th, 2026

   A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. The malware features worm-like capabilities and was discovered in an unauthenticated Docker registry that contained nearly 60 repositories and 4.3 GB of image data. ThreatDown researchers at cybersecurity company Malwarebytes retrieved operational evidence spanning October 2024 to August 2026. The archive also included details about the botnet and a separate campaign that distributed counterfeit cryptocurrency wallet apps. The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host. At the same time, scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence. One notable aspect of the attack is that the AI agent framework Hermes Agent is installed on the hosts, using an agent named “GH0ST,” with instructions that overwrite the default ‘SOUL.md’ persona file. The GH0ST agent instructions Source: ThreatDown Hermes has been extensively abused in malicious cyber-operations recently . Recently, cybersecurity company Gambit documented a large-scale card-skimming operation that stole 600.000 credit car

5. mentioned by tugatech.com.pt

   Carbonato malware infects Docker servers and installs AI agent to take full control

   tugatech.com.pt · 19d ago · September 24th, 2026

6. update from cyberpress.org

   CARBONATO Botnet Uses AI Agent to Hijack Exposed Docker Hosts and Steal Cloud Credentials

   cyberpress.org · 18d ago · September 25th, 2026

   The malware spreads automatically across reachable networks, while its operators use Telegram to direct activity on compromised systems. The discovery began with an unauthenticated Docker registry exposed to the internet. It uses the Docker API to start a privileged container with the host filesystem mounted and access to the host’s process and network namespaces. From that container, it can run commands on the underlying host. CARBONATO Botnet Hijacks Docker Hosts The implant establishes remote access through a reverse SSH tunnel and sends deployment details, including the victim’s hostname and IP address, to Telegram. It disguises its container as systemd-resolved and can make a process appear to be a kernel worker thread. Cron jobs, systemd timers, rc.local and OpenRC provide persistence; watchdogs can pull the implant again if it is removed. New victims receive the implan

7. update from securityaffairs.com

   AI-powered CARBONATO botnet steals credentials to fund its own LLM gateway

   securityaffairs.com · 18d ago · September 25th, 2026

   SecurityAffairs covers CARBONATO, the AI-powered botnet that steals credentials, prioritizing AI API keys, to fund the operation's own LLM gateway serving 27 models.

8. update from dev.to

   1. Basic Information Original Title: CARBONATO: a botnet built around an AI agent Source:... # security # threatintel # software # coding #

   dev.to · 18d ago · September 25th, 2026

   Basic Information Original Title: CARBONATO: a botnet built around an AI agent Source:... # security # threatintel # software # coding #

   via Mastodon https://dev.to/anoymask/carbonato-a-botnet-built-around-an-ai-agent-via-exposed-docker-apis-fn9

9. mentioned by thehackernews.com

   Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent https:// thehackernews.com/2026/09/carb onato-botnet

   thehackernews.com · 15d ago · September 28th, 2026