Carbonato Botnet Abuses Exposed Docker APIs to Deploy AI Agent Framework for Takeover

Security researchers have identified a new botnet malware, tracked as Carbonato, that targets hosts running insecure, internet-exposed Docker daemons. According to reporting from BleepingComputer, once Carbonato gains access to a vulnerable Docker host, it installs the Hermes Agent AI framework as a means of taking control of the system. Details on the malware's full capabilities, scale, and infrastructure are still emerging.

Why It Matters

Docker hosts with an exposed, unauthenticated daemon API (commonly TCP port 2375, or a misconfigured 2376) have long been a reliable initial-access vector for opportunistic botnets, since the API allows an attacker to create and run arbitrary containers with host-level privileges. What sets Carbonato apart is its reported use of an AI agent framework as the mechanism for post-compromise control rather than a traditional bot client — a notable shift that could give operators more flexible, autonomous decision-making inside compromised environments. Organizations running self-managed Docker infrastructure, especially in cloud or hybrid environments where daemon exposure is a common misconfiguration, are the population at risk.

What Defenders Should Watch For

• Audit external and internal exposure of the Docker daemon API — ports 2375/2376 should never be reachable without TLS client-cert authentication, and ideally not reachable from the internet at all.
• Hunt for unexpected or unrecognized containers, especially ones created via the Docker API rather than through normal deployment tooling, and review container images for unfamiliar AI-agent or LLM-framework packages.
• Watch for anomalous outbound network activity from container hosts, particularly to AI/LLM API endpoints, which could indicate an agent framework operating with attacker-controlled instructions.
• Review Docker daemon and container runtime logs for API calls invoking container creation, image pulls, or privilege escalation (e.g., mounting the host filesystem) from unexpected source IPs.
• Ensure Docker daemons require authentication and restrict access via firewall rules or a bastion/VPN, consistent with standard Docker hardening guidance.

This is a developing story and detail on Carbonato's full tradecraft, indicators of compromise, and scope of impact had not been fully disclosed at time of writing. We will track this item for updates and will publish a dedicated detection if concrete technical indicators emerge. Read the original report at BleepingComputer.