--- title: Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts description: ThreatDown researchers uncovered Carbonato, a botnet that targets unauthenticated Docker daemons exposed on port 2375, launches privileged containers, installs... canonical: https://daily.dev/posts/carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-f2mcj4rql twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts | daily.dev og:description: ThreatDown researchers uncovered Carbonato, a botnet that targets unauthenticated Docker daemons exposed on port 2375, launches privileged containers, installs... og:url: https://daily.dev/posts/carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-f2mcj4rql og:image: https://api.daily.dev/og/posts/F2mCj4rql.png og:image:alt: Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts **[Dark Reading](https://daily.dev/sources/dr)** · 4 min read · 0 upvotes · 0 comments ## Summary ThreatDown researchers uncovered Carbonato, a botnet that targets unauthenticated Docker daemons exposed on port 2375, launches privileged containers, installs an SSH reverse tunnel for persistence, and deploys an AI agent built on the open source Hermes Agent framework from Nous Research. The agent executes attacker commands via Telegram and is prioritized to steal AI API keys ahead of other credentials like SSH keys and access tokens. Separate conventional scripts scan nearby networks for more exposed Docker hosts to spread the infection. Clues in timestamps, language use, and a Telegram handle suggest the operators may be based in Costa Rica. Docker confirmed the port 2375 exposure issue has been known since 2013 and ships disabled by default, requiring a user misconfiguration to be exploitable. Defenders are advised to avoid exposing the Docker daemon API, require registry authentication, and rotate AI API keys as sensitive credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Carbonato botnet compromise Docker hosts? It targets servers running unauthenticated Docker daemons exposed on port 2375, an unencrypted REST API endpoint for remote Docker connections. The attacker instructs the exposed service to launch a privileged container with access to the host's file system, processes, and network, then installs a persistent SSH reverse tunnel and an AI agent that receives commands via Telegram. _Teams securing container infrastructure follow emerging Docker attack techniques like this on daily.dev._ ### What does the AI agent in the Carbonato botnet actually do? It is based on Hermes Agent, an open source MIT-licensed agent framework from Nous Research, guided by a 39-line prompt instructing it to execute tasks from an attacker-controlled Telegram chat, maintain persistence, and collect credentials. It prioritizes stealing AI API keys above access tokens, SSH keys, and databases, while separate non-AI scripts spread the infection to other exposed Docker hosts. _Developers tracking how AI agents get weaponized in attacks can follow this space on daily.dev._ ### Is Docker's port 2375 exposure a new vulnerability I need to patch? No, this unencrypted remote API port issue has been documented since 2013 and every new Docker installation ships with it disabled by default. Exploitation requires a user to actively reconfigure Docker to expose the port, something Docker explicitly advises against; defenders should keep the daemon API unexposed and require authentication on every registry. _Anyone hardening Docker configurations can keep tabs on container security guidance via daily.dev._ ## Similar posts on daily.dev - [Agentic threat actor hits the orchestration plane: AI agent-driven container escape](https://daily.dev/posts/agentic-threat-actor-hits-the-orchestration-plane-ai-agent-driven-container-escape-j35vuwuki) · Sysdig Blog · 0 upvotes · 0 comments - [BioShocking Attack Shows How AI Browsers Can Be Tricked Into Stealing User Credentials](https://daily.dev/posts/bioshocking-attack-shows-how-ai-browsers-can-be-tricked-into-stealing-user-credentials-bbuo1dpir) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#docker](https://daily.dev/tags/docker), [#containers](https://daily.dev/tags/containers) [View this post on daily.dev](https://daily.dev/posts/carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-f2mcj4rql) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts","url":"https://daily.dev/posts/carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-f2mcj4rql","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-f2mcj4rql"},"datePublished":"2026-09-28T20:44:37.470Z","dateModified":"2026-09-28T20:45:49.547Z","description":"ThreatDown researchers uncovered Carbonato, a botnet that targets unauthenticated Docker daemons exposed on port 2375, launches privileged containers, installs...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fb8ee3fa8b7534be612c20bef1771a7e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fb8ee3fa8b7534be612c20bef1771a7e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-f2mcj4rql","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,docker,containers","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-f2mcj4rql#faq","mainEntity":[{"@type":"Question","name":"How does the Carbonato botnet compromise Docker hosts?","acceptedAnswer":{"@type":"Answer","text":"It targets servers running unauthenticated Docker daemons exposed on port 2375, an unencrypted REST API endpoint for remote Docker connections. The attacker instructs the exposed service to launch a privileged container with access to the host's file system, processes, and network, then installs a persistent SSH reverse tunnel and an AI agent that receives commands via Telegram. Teams securing container infrastructure follow emerging Docker attack techniques like this on daily.dev."}},{"@type":"Question","name":"What does the AI agent in the Carbonato botnet actually do?","acceptedAnswer":{"@type":"Answer","text":"It is based on Hermes Agent, an open source MIT-licensed agent framework from Nous Research, guided by a 39-line prompt instructing it to execute tasks from an attacker-controlled Telegram chat, maintain persistence, and collect credentials. It prioritizes stealing AI API keys above access tokens, SSH keys, and databases, while separate non-AI scripts spread the infection to other exposed Docker hosts. Developers tracking how AI agents get weaponized in attacks can follow this space on daily.dev."}},{"@type":"Question","name":"Is Docker's port 2375 exposure a new vulnerability I need to patch?","acceptedAnswer":{"@type":"Answer","text":"No, this unencrypted remote API port issue has been documented since 2013 and every new Docker installation ships with it disabled by default. Exploitation requires a user to actively reconfigure Docker to expose the port, something Docker explicitly advises against; defenders should keep the daemon API unexposed and require authentication on every registry. Anyone hardening Docker configurations can keep tabs on container security guidance via daily.dev."}}]} ```