Carbonato botnet used the Hermes Agent framework to run commands on hijacked Docker hosts
What happened
ThreatDown found a botnet that takes over Docker hosts with an unauthenticated API, installs the open-source Hermes Agent and rewrites its persona file so the agent collects credentials, with AI API keys first. Operators send tasks through Telegram. The number of infected hosts is not stated.
Carbonato targets Docker daemons reachable on port 2375 without authentication, launches a privileged container for host access, opens a reverse SSH tunnel and sets up several persistence methods. It installs Hermes Agent from Nous Research unmodified and replaces its SOUL.md persona file with a 39-line prompt telling the agent to stay persistent, follow Telegram instructions and collect credentials. The agent forwards tasks to the operation's LLM gateway and runs the returned terminal commands. A script, not the agent, scans nearby networks every five minutes for more exposed Docker daemons. ThreatDown found the malware and operational records in an unauthenticated Docker registry, with evidence running from October 2024 to August 2026, and could not tie it to a known group in BleepingComputer's account. ThreatDown's clues, including language, a Telegram handle and tunnel endpoints, point to operators based in Costa Rica.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
Sources do not say whose AI model was involved. The product was Hermes Agent, which is open source, a type of AI agent.
Impact
Data was exposed. Data involved: credentials. The impact was limited to a small number of people or a single system.
Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 22 Sep 2026.
ThreatDown published its findings and indicators. The sources report no vendor or victim response.