Security researchers disclosed a new botnet malware called Carbonato on September 24, 2026, that targets exposed Docker daemon hosts using an embedded AI agent framework for autonomous operation. The malware installs Hermes Agent AI to take control of compromised Docker hosts, representing an emerging trend of botnet operators integrating AI agent capabilities for more autonomous malware behavior.
Carbonato Targets Exposed Docker Daemons with AI-Powered Automation
Carbonato specifically targets internet-exposed Docker daemons running with weak or no authentication. Docker daemons are the background services that manage Docker containers on a host system, and when exposed to the internet without proper access controls, they provide attackers with direct access to container management APIs. Attackers can use this access to deploy malicious containers, extract sensitive data from existing containers, or—as Carbonato demonstrates—install malware that takes over the entire host system.
The malware’s use of Hermes Agent AI framework distinguishes it from traditional botnet malware that follows pre-programmed command sequences. AI agent frameworks enable malware to make autonomous decisions about how to operate on compromised systems, potentially adapting to different host configurations, defensive measures, or operational objectives without requiring updated instructions from command-and-control infrastructure. This autonomous capability allows botnet operators to deploy malware that can respond to changing conditions without manual intervention.
Hermes Agent AI Integration for Autonomous Host Control
Hermes Agent AI serves as the decision-making component within Carbonato, handling the malware’s operation on compromised Docker hosts. While the disclosure does not detail the specific capabilities Hermes Agent provides, AI agent frameworks typically handle tasks like environment reconnaissance, privilege escalation path discovery, lateral movement target identification, and defensive evasion technique selection—all activities that previously required either human operator intervention or rigid pre-programmed logic.
The integration of an AI framework into botnet malware represents a significant evolution in malware architecture. Traditional botnets rely on centralized command-and-control servers to direct bot behavior, creating a single point of failure that law enforcement and security researchers can disrupt. AI-enabled bots that can operate autonomously reduce dependence on C2 infrastructure, making the botnet more resilient to takedown efforts and enabling continued operation even when communication with controllers is interrupted.
Docker Daemon Exposure and Container Security Risks
Docker daemons exposed to the internet without authentication create an immediate remote access vulnerability. The Docker API provides complete control over container operations, including the ability to run containers with host-level privileges, mount host filesystems into containers, and execute arbitrary commands within containers. An attacker with unauthenticated access to a Docker daemon effectively has root-level control over the host system through container manipulation.
Organizations often expose Docker daemons to enable remote management, CI/CD pipeline access, or container orchestration across distributed environments. However, exposing the daemon without implementing TLS encryption and certificate-based authentication allows any network-reachable attacker to manage containers and compromise the host. The Docker security model assumes daemon access is equivalent to root access, making proper authentication and network-level access controls critical for any non-local Docker deployment.
Botnet Operations on Containerized Infrastructure
Carbonato’s targeting of Docker hosts reflects botnet operators’ recognition that containerized infrastructure represents valuable compromise targets. Docker hosts often run in cloud environments with high-bandwidth network connections, making them suitable for distributed denial-of-service attacks, cryptocurrency mining, or serving as infrastructure for other malicious activities. Container platforms also frequently have access to sensitive data—application secrets, database credentials, API keys—stored in environment variables or mounted volumes, providing additional value beyond compute resources.
The Docker compromise vector also enables persistence mechanisms that can survive container lifecycle events. By compromising the Docker host rather than just deploying malicious containers, Carbonato can maintain access even when containers are stopped, removed, or replaced through normal operations. Host-level compromise allows the malware to redeploy itself into new containers, modify container images, or persist through traditional host-based mechanisms.
Defender Response: Securing Docker Daemon Access
Organizations running Docker must ensure daemons are not exposed to the internet without authentication. Docker’s recommended deployment model keeps the daemon accessible only to local processes or through encrypted TLS connections with certificate-based authentication. Network firewalls should block external access to the default Docker daemon port (2375 for unencrypted, 2376 for TLS), and any remote access should route through VPNs or bastion hosts rather than direct internet exposure.
Administrators should audit existing Docker deployments to identify exposed daemons. Network scans can detect Docker API endpoints listening on external interfaces, and cloud security posture management tools can flag Docker hosts with overly permissive firewall rules. Any Docker host that was previously exposed without authentication should be treated as potentially compromised, requiring forensic investigation to determine whether Carbonato or other malware gained access before the exposure was corrected.
The Carbonato disclosure also highlights the need for monitoring container and host activity for signs of unauthorized access or malicious behavior. Unusual container deployments, unexpected resource consumption, or containers running with elevated privileges can indicate compromise. Docker audit logging that tracks API calls, container lifecycle events, and privilege escalations provides visibility into daemon usage patterns that can help detect both Carbonato and other Docker-targeting malware.
AI Agent Malware and the Autonomous Threat Landscape
Carbonato’s integration of Hermes Agent AI represents a broader trend in malware development: the incorporation of AI agent frameworks to create more autonomous, adaptive malicious software. While AI-powered cyberattacks have long been discussed as a theoretical threat, Carbonato demonstrates practical implementation of AI agents in real-world malware campaigns. The trend creates new challenges for defenders, as autonomous malware can potentially discover novel exploitation paths, adapt to defensive measures, and operate effectively with reduced dependence on command-and-control infrastructure.
The relatively low barrier to integrating open-source AI frameworks into malware suggests this trend will accelerate. The same AI agent tools developed for legitimate automation, system administration, and security research can be repurposed for malicious autonomous operation. As these frameworks become more capable and easier to integrate, the distinction between traditional scripted malware and AI-enabled autonomous malware will continue to narrow, creating an expanding threat landscape that demands equally sophisticated defensive capabilities.
