IncidentsCarbonato malware plants AI agents on exposed Docker hosts
A botnet reported on 24 September 2026 installs the Hermes Agent AI framework on machines running internet-facing Docker daemons, according to BleepingComputer.
24 Sept 2026
Carbonato Malware Uses AI Agents to Hijack Exposed Docker Hosts
A newly identified botnet malware named Carbonato targets insecure hosts running exposed Docker daemons, installing the Hermes Agent AI framework to take control of the compromised systems.
Disclosed 24 September 2026 · Record updated 1 October 2026
Impact
Carbonato malware exploits misconfigured, internet-exposed Docker daemons to install an AI agent framework (Hermes Agent) and hijack the hosts for botnet activity.
Our coverage
IncidentsSources
- bleepingcomputer.comhttps://bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts