Carbonato botnet installs AI agent on hacked Docker hosts

A botnet dubbed Carbonato is compromising exposed Docker hosts and installing an AI agent on them, according to a Dark Reading report published on 28 September 2026.

The agent is built on Hermes Agent, an open-source AI agent framework. Once it is running on a victim machine, the report says, the attackers can execute commands through Telegram, a messaging service, and steal AI API keys from the compromised host. API keys are the credentials that let software call a paid AI service, so anyone holding them can spend the owner's budget or reach the owner's data.

The victims are Docker hosts that are exposed to the internet. Docker is container software widely used to run applications on servers. Exposed Docker hosts have long been a favourite target for opportunistic attackers because a management interface reachable from the open internet can let anyone who finds it start containers. In this case the entry point is a misconfiguration rather than a software flaw: nothing in the report points to a vulnerability in Docker itself or in the Hermes Agent framework.

What makes the campaign notable is the payload. Botnets have historically dropped cryptocurrency miners, proxies or simple remote-access tools on the servers they take over. Carbonato instead drops an AI agent, a program that can plan and carry out multi-step tasks on its own and that can be steered in natural language. The practical effect described by Dark Reading is a command channel over Telegram, which gives the operators a convenient interface and hides their traffic inside a legitimate, widely used service.

The theft of AI API keys is the second half of the picture. Stolen keys are a form of currency: they can be resold, or used to run the attackers' own AI workloads at someone else's expense. Organisations that run AI services often keep those keys in environment variables or configuration files on the same servers that host their applications, which is exactly where an agent with local command execution would look.

Several things are not yet public. The report as published does not say how many hosts have been compromised, when the campaign began, which regions or industries are affected, or who is behind it. There is no named vendor at fault, because the weakness being exploited is in how operators configure their own systems. Hermes Agent is an open-source project being abused by the attackers, not a product that has been breached.

For defenders, the exposure is the familiar one. Docker management endpoints should not be reachable from the internet, and hosts that run AI workloads should be treated as credential stores, because they are. Rotating AI API keys, scoping them to the minimum permissions needed and setting spending limits reduces the value of a theft. Outbound traffic to consumer messaging platforms from a production server is also a useful signal, since that is the channel the report describes the operators using for control.

The broader point in the Dark Reading account is that agent frameworks are now general-purpose tooling. They are freely available, easy to deploy and designed to act with autonomy on a machine, which is precisely the capability an intruder wants after gaining a foothold. Carbonato is an example of criminals reaching for the same open-source agent software that legitimate developers use.