Carbonato Botnet Weaponizes AI Agents to Hijack Docker Hosts

Introduction

The landscape of cloud-native threats has taken a sharp turn with the emergence of Carbonato, a botnet campaign that integrates a fully functional Artificial Intelligence agent into its payload. Unlike traditional scripts that rely on hardcoded routines, this malware utilizes the open-source Hermes Agent framework to interpret natural language commands sent via Telegram, effectively turning compromised Docker hosts into semi-autonomous nodes capable of complex reasoning and data theft. This article dissects the mechanics of this attack, the implications of AI-driven malware, and the necessary defenses for containerized environments.

Anatomy of the Carbonato Intrusion Chain

The attack begins with a familiar but persistent vector: the exposure of the Docker Engine API (typically port 2375 or 2376) to the public internet without authentication. Threat actors continuously scan the IPv4 space for these open ports. Once a vulnerable host is identified, the adversary uses the Docker API to spawn a malicious container, often binding the host's filesystem to the container to facilitate escape and persistence.

What distinguishes Carbonato is the payload deployed inside this container. Instead of a simple cryptominer or a reverse shell, the container runs a Python-based implementation of the Hermes Agent. This framework is designed to function as an autonomous AI assistant, capable of using tools, browsing the web, and executing code. In the hands of attackers, it becomes a powerful post-exploitation framework that can "think" through the environment.

The Role of the Hermes AI Framework

Hermes is an open-source project intended to help developers build AI agents that can interact with operating systems and APIs. Carbonato repurposes this legitimate tool for offensive operations. The agent is configured with a system prompt that defines its role as a system administrator with full access to the host via the mounted volumes.

• Natural Language C2: Operators communicate with the botnet via a private Telegram channel or bot. They issue commands in plain English, such as "Find all API keys in /root and exfiltrate them" or "Scan the internal subnet 172.17.0.0/16 for vulnerable services."
• Tool Use & Reasoning: The LLM (Large Language Model) backend—likely a local model or an API call to a major provider—parses the intent, selects appropriate tools (shell execution, file reading, network scanning), executes them, and reasons about the output to decide the next step.
• Credential Harvesting Focus: Telemetry indicates a specific focus on stealing API keys for AI services (OpenAI, Anthropic, Hugging Face, cloud provider keys). These keys are high-value targets because they can be monetized directly or used to train/fine-tune models at the victim's expense.

Telegram as a Resilient Command & Control Layer

The choice of Telegram for Command and Control (C2) is strategic. It provides end-to-end encryption (in secret chats), a robust API for bot integration, and domain fronting capabilities that make traffic blocking difficult for network defenders. Because the C2 traffic blends in with legitimate HTTPS traffic to Telegram's infrastructure, standard egress filtering often fails to detect the beaconing. Furthermore, the asynchronous nature of messaging allows the AI agent to process complex, multi-step tasks without requiring a persistent, low-latency socket connection, reducing the forensic footprint on the host.

Implications for AI Supply Chain Security

This campaign highlights a critical blind spot in modern software supply chains: the weaponization of AI development frameworks. Hermes, LangChain, AutoGPT, and similar tools are designed to give LLMs agency—the ability to act on the world. When these frameworks are deployed in production environments or included in container images without strict guardrails, they become potent attack surfaces. Carbonato demonstrates that an attacker does not need to write custom exploit code for every scenario; they simply need to prompt the agent to "figure it out." This lowers the barrier to entry for sophisticated post-exploitation activities significantly.

Mitigation Strategies for Docker Environments

Defending against Carbonato requires a layered approach addressing the root cause (exposure) and the symptom (AI agent execution).

1. Eliminate Public Docker API Exposure: This is non-negotiable. The Docker daemon socket (docker.sock or TCP ports) must never be exposed to the internet. Use SSH tunneling, VPNs, or dedicated management tools (Portainer, Rancher) with RBAC for remote management.
2. Enforce Rootless Containers & User Namespaces: Running the daemon and containers in rootless mode significantly limits the blast radius of a container escape, preventing the agent from easily mounting the host filesystem or accessing sensitive directories like /etc/shadow or SSH keys.
3. Implement Runtime Security (e.g., Falco, Tetragon, Tracee): Deploy kernel-level runtime security tools to detect the specific behaviors exhibited by Hermes agents: execution of LLM binaries/python scripts with network access, reading of sensitive credential files, and spawning of interactive shells inside containers.
4. Egress Filtering & DNS Monitoring: Block outbound traffic to unknown AI endpoints. Allowlist only the specific AI provider APIs your organization uses. Monitor DNS logs for connections to Telegram API domains (api.telegram.org) from server subnets.
5. Secrets Management: Never bake API keys into images or leave them as environment variables in plaintext. Use dedicated secrets managers (HashiCorp Vault, AWS Secrets Manager, Kubernetes Secrets with encryption at rest) and inject them at runtime via sidecars or CSI drivers.

Conclusion

The Carbonato botnet serves as a stark proof-of-concept that the theoretical risks of offensive AI agents are now operational realities. By combining the ubiquity of misconfigured Docker daemons with the reasoning capabilities of frameworks like Hermes, threat actors have created a scalable, adaptable, and stealthy compromise mechanism. The theft of AI API keys adds a direct financial incentive that will likely drive rapid adoption of these techniques across the cybercrime ecosystem.

Securing the container lifecycle—from image build to runtime behavior—is no longer just about preventing cryptojacking; it is about preventing the hijacking of your compute and cognitive resources. As AI agents become standard components in software architectures, the line between a legitimate automation script and a malicious implant will blur further. Grivyonx Cloud specializes in securing this exact intersection, offering AI-driven runtime protection and autonomous threat hunting capabilities designed to detect and neutralize cognitive threats like Carbonato before they exfiltrate your intellectual property or consume your AI budget.