AI Risk Wire

Cases › security breach › LR-2026-0731

CARBONATO AI-driven botnet hijacks Docker hosts and steals credentials

Confirmed Why: 3 independent outlets · 3 independent reports

Status: advice only, no fix reported

Severity moderate
Reported 24 Sep 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Carbonato is a Docker-based botnet, active since at least October 2024, that targets Docker daemons exposed on port 2375 without authentication. It launches a privileged container with access to the host, opens a reverse SSH tunnel, and installs the open-source Hermes Agent framework, which the operators reconfigure with a persona file named GH0ST. Operators send tasks through Telegram; the agent writes terminal commands, reads the output, and collects AI API keys, SSH credentials and access tokens. Scripts scan nearby networks every five minutes and spread the implant to other exposed hosts. ThreatDown found the operation after an unauthenticated container registry was exposed on the internet, and reported it in September 2026. The operators are likely based in Costa Rica, although attribution is not confirmed. The sources do not state the number of compromised hosts or any losses.

What happened

1 · What it was doingOperators reconfigured the Hermes Agent framework with a persona called GH0ST, instructed to act as a post-exploitation tool and carry out Telegram commands.
2 · What went wrongDocker daemons exposed on port 2375 without authentication allowed the malware to launch a privileged container with access to the host.
3 · What it reached or didScripts scanned attached networks every five minutes and spread the implant to other exposed Docker daemons.
4 · How it was caughtThreatDown researchers found the operation after an unauthenticated container registry exposed on the internet was discovered.

What was done

Advice in source, not a fix by the party

“To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries.”

Multi-factor sign-in and password policy Network segmentation

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

No source states: when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 4 items from the primary sources

What happened, in order

  1. 2024-10 Botnet activity evidenced as active since at least October 2024.
  2. 2026-08 ThreatDown researchers discovered the operation.
  3. 2026-09-03 The operators' LLM gateway was observed live, funded by stolen keys.

Not dated in the sources:

  • Operational evidence retrieved by ThreatDown covers October 2024 to August 2026.
Show every field, with its source and grade

The AI system

What it was allowed to do
privileged container with access to the host
C one secondary source states it
What it was for
post-exploitation tool: maintain persistence and carry out Telegram commands
C one secondary source states it

What happened

When it happened
2024-10-01
C one secondary source states it
Earliest source we hold
2026-09-24
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
Cause in detail
Docker daemon API on port 2375 exposed without authentication
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK07
D inferred by us from the described behaviour, reason shown
secondary risks
RK03
D inferred by us from the described behaviour, reason shown
remediations
kind: advice; controls added: J3, J2; quote: To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries.; source index: 0
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Who was affected
Docker hosts with an API exposed on port 2375 without authentication
C one secondary source states it
Kinds of data exposed
AI API keys, SSH credentials, access tokens
C one secondary source states it

Notes on gaps

Control E1 as missing is an inference from the privileged container giving host access; no source names sandboxing.

LR-2026-0731 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON