Carbonato malware plants AI agents on exposed Docker hosts

A new botnet malware called Carbonato is targeting insecure hosts that run Docker daemons, installing the Hermes Agent AI framework and taking control of the machines, BleepingComputer reported on 24 September 2026.

The report describes the targets as insecure hosts running Docker daemons. Docker Engine's daemon is the background process that creates and manages containers on a host. When that daemon is reachable over a network without authentication, anyone who can connect to it can generally do whatever the daemon can do on the host. That makes exposed daemons a long-standing target for automated attacks, and in this case the entry point is a misconfiguration rather than a flaw in Docker's code. No vulnerability or CVE has been attributed to Docker in connection with Carbonato in the reporting available.

What distinguishes Carbonato, according to the report, is what it does after it gets in. Rather than only dropping a fixed payload, it installs Hermes Agent, an AI agent framework, and uses it to take control of the compromised system. An agent framework is software that lets a language model plan and carry out actions on a machine, such as running commands or calling tools, instead of a human operator issuing each instruction. Deploying one on a victim host effectively hands part of the operator's job to software running on the victim's own hardware.

The practical security question that raises is one of detection. Defenders who look for known malicious binaries and fixed command-and-control patterns may see, instead, a legitimate open-source framework and traffic to a model provider. The reporting does not say how Carbonato is being detected, how many hosts have been compromised, who is behind it, or what the botnet is ultimately used for. Those details are not established by the available source and should not be assumed.

The incident is currently at the reported stage. There is no indication that Docker has issued a patch or advisory in response, and none would necessarily be expected for an attack that relies on how administrators expose the daemon rather than on a defect in the product.

For operators, the exposure in question is well understood even if this particular botnet is new. A Docker daemon that accepts connections from the internet, without TLS client certificates or other authentication in front of it, is an administrative interface open to the world. Reviewing which hosts expose the Docker API, and to whom, is the control that matters here. Further technical detail on Carbonato's behaviour, including indicators of compromise, will depend on follow-up analysis that has not yet been published.