CARBONATO research exposes a botnet using a stock AI agent

ThreatDown’s September 22 research describes CARBONATO, a botnet targeting unauthenticated Docker services. Its implant installs the legitimate Hermes Agent framework and changes its instructions to support Telegram-directed activity, persistence and credential collection. AI API keys receive particular priority in the recovered instructions.

Brief updated 25 Sep 2026, 02:25 UTC · AI-written

Researchers reconstructed the operation from an exposed container registry collected in August. This is newly published research into an existing operation, rather than evidence that the botnet started this week.

The entry point is Docker’s exposed administrative API on port 2375. The malicious configuration repurposes an unchanged agent framework after entry; the report does not describe an AI-discovered vulnerability as the initial infection mechanism.

What remains unclear

The report’s infrastructure availability check dates to September 3.