Security2 hSeptember 28, 2026, 18:46

Carbonato Botnet Hits Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent

Researchers disclosed a new botnet malware called Carbonato that targets exposed Docker daemons to deploy the open-source Hermes Agent AI framework. The implant overwrites the SOUL.md persona file with a 39-line prompt that makes the agent execute tasks received via Telegram.

The Hacker News

Open source

Carbonato Botnet Hits Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent

Carbonato targets exposed Docker daemons
Deploys open-source Hermes Agent framework
Overwrites SOUL.md with a 39-line prompt
Agent is controlled through Telegram

#Docker#HermesAgent#Telegram

Cybersecurity roundup: Clop leak site seized, Docker botnet hunts AI keys, water utility exposure

Security

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Security

Malicious AI agents steal 600K credit cards, infect 119 sites with skimmers

Security

Carbonato Botnet Hits Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent

Cybersecurity roundup: Clop leak site seized, Docker botnet hunts AI keys, water utility exposure

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Malicious AI agents steal 600K credit cards, infect 119 sites with skimmers

x47.c Windows botnet uses xAI Grok for persistence and AI credit draining