A New Breed of Malware Emerges, Using AI Agents to Hijack Exposed Docker Hosts
Cybersecurity researchers have discovered a sophisticated new malware botnet, dubbed Carbonato, that is targeting insecure hosts running Docker daemons. The malware uses artificial intelligence (AI) agents to hijack exposed Docker hosts, making it a particularly concerning development for organizations that rely on containerized applications.
Carbonato spreads across Docker hosts by exploiting an API that is exposed without authentication, typically on port 2375. Once inside, the malware connects to this API and instructs the daemon to launch a privileged container, giving it access to the host. It then opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and reports the new deployment through Telegram.
What’s particularly noteworthy about Carbonato is its use of the Hermes Agent AI framework, which has been extensively abused in malicious cyber-operations recently. The AI agent, named “GH0ST,” handles task commands received through Telegram, including collecting sensitive data such as AI API keys, SSH credentials, access tokens, and more.
The researchers describe this process as an operator-driven exchange, involving an interactive command loop where the model interprets tasks, writes terminal commands, reads output, and decides what to do next. This allows the attackers to remotely control the compromised hosts, running commands and collecting data with ease.
Carbonato’s worm-like capabilities enable it to spread to other exposed Docker daemons, making it a potentially highly contagious threat. The malware’s scripts scan networks attached to the host every five minutes, pulling the implant from an unauthenticated Docker registry and launching the same privileged container on each new compromise.
While researchers were unable to attribute Carbonato to any known threat clusters, they did point to Costa Rica as a possible location of the operator. To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries.
The emergence of Carbonato highlights the growing threat posed by AI-powered attacks, which can evade traditional security measures with ease. As organizations increasingly rely on containerized applications, it’s essential to stay vigilant about securing these environments and implementing robust controls to prevent such threats from spreading.
To protect yourself and your organization, ensure that Docker daemon APIs are not exposed without authentication, and implement strict access controls for registries. Monitor your systems closely for signs of Carbonato attacks, including unusual Telegram traffic or reverse SSH tunnels toward AS262145.
Source: Bleeping Computer — 2026-09-24