Carbonato botnet turns hijacked Docker hosts into AI agents

Security researchers have described a new botnet called Carbonato that breaks into exposed Docker daemons and uses them to run an open-source AI agent framework, according to findings published on 28 September 2026 by ThreatDown.

The details were reported by The Hacker News, which said researchers had disclosed how the malware targets Docker daemons — the background service that manages containers on a host — that are reachable from the internet. Once on a machine, the implant installs the Hermes Agent framework, an open-source AI agent project, without modifying it.

The twist is what happens next. "The implant installs the framework unchanged, then overwrites its SOUL.md persona file," ThreatDown said. A persona file of that kind sets out the standing instructions an AI agent follows. Carbonato replaces it with a 39-line prompt that, according to the researchers, directs the agent to execute tasks received through Telegram, the messaging service.

That design means the attacker does not need to write much malicious code of their own. The capability comes from a legitimate, unaltered agent framework; the malicious part is the text file that tells the agent what to do and where to take orders from. Command and control runs over a consumer messaging platform rather than bespoke infrastructure.

The root cause reported here is misconfiguration rather than a software flaw. Docker daemons that accept connections from the public internet can be instructed to create and run containers, and no vulnerability in Hermes Agent itself has been described in the disclosure. There is no CVE attached to the activity as reported.

The available reporting does not say how many hosts have been compromised, when the campaign began, who is behind it, or what tasks the operators have actually sent to the agents. Nor does it name specific victims or regions. ThreatDown's write-up, as summarised by The Hacker News, focuses on the implant's structure and the use of the persona file as the control mechanism.

For defenders, the practical detail is that an AI agent binary on a server may be entirely genuine while its instructions are not. Detection that looks only for tampered executables or known-bad code would miss an unchanged framework paired with a hostile configuration file. Monitoring for unexpected agent frameworks on production hosts, watching for changes to persona and prompt files, and closing off internet-facing Docker daemons are the controls implied by the reported behaviour.

The campaign is one of a small but growing number of cases in which attackers reuse off-the-shelf agent software as their payload. The status of the activity, as reported, is ongoing and under investigation.