Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts

The Carbonato botnet campaign exploits Docker hosts that have been left exposed to the internet without proper access controls or network restrictions, allowing attackers to deploy the Hermes AI Agent framework and execute commands remotely via Telegram. The root cause is a failure in configuration management — Docker APIs should never be publicly accessible without authentication and strict firewall rules. What makes this campaign particularly dangerous is the weaponization of legitimate AI frameworks, enabling automated, scalable attacks that can rapidly harvest API keys and cloud credentials. Stolen AI API keys can lead to significant financial losses, data breaches, and further lateral movement within cloud environments, compounding the damage well beyond the initial compromise.