Carbonato Turns an Unmodified Open-Source AI Agent Into a Docker Botnet’s Operator Console

Building a command-and-control interface used to mean writing one. An attacker who wanted a remote operator to interactively issue commands to a compromised host, read the output, and decide what to do next needed custom code: a listener, a protocol, a client. Research that ThreatDown published on September 22 into a Docker-hijacking botnet called Carbonato shows that requirement disappearing. The botnet’s operators did not build an interactive command console. They downloaded Hermes Agent, Nous Research’s real, MIT-licensed, open source AI agent framework, sitting at roughly 249,000 stars on GitHub as of this writing, installed it completely unmodified on every host they compromised, and replaced a single configuration file to make it theirs.

Two days later, on September 24, the same day BleepingComputer’s own report on Carbonato reached a wider readership, Hermes Agent had an entirely unrelated, much more flattering moment. Nous Research joined Docker on stage at the WeAreDevelopers North America conference to run the same framework inside a Docker Sandbox as what Docker called a “first-class Kit,” a demonstration sxz.io covered as part of Docker’s new Sandbox Kit Specification. Nothing connects the two events beyond the shared subject; the timing is a coincidence, not a causal link. But it frames the actual finding more precisely than any deliberate comparison could. Hermes Agent is capable and trusted enough to be a legitimate partner in one of the year’s more consequential agent-security announcements, and a criminal operator’s entire interactive command interface, for the same underlying reason: it already does what an operator needs, exactly as shipped.

A Registry Left Open Since May

ThreatDown found Carbonato by accident, during what its writeup calls “routine threat hunting” for exposed Docker services. In August 2026, researchers located a US-based server running a Docker Registry on port 5000 with no authentication required. Two read-only requests confirmed the exposure: a call to the registry’s own catalog endpoint returned a plain JSON list of 59 repositories, among them names like backdoor, fsociety/agent, gh0st/c2, gh0st-hijack-layer, and xmrig-agent. Internet-wide scanners had already indexed the registry as far back as May 2026, meaning it sat open to anyone who thought to look for months before ThreatDown’s team did.

One day of passive, read-only collection pulled in 4.3 GB of image data across 234 image tags and 605 SHA-256-verified blobs, roughly 945,000 individual files. The image timestamps span October 2024 through August 2026, and the archive documents two distinct, linked criminal product lines: a factory building trojanized cryptocurrency wallet apps, and the Carbonato botnet itself. Critically, the registry did not just leak the malware’s binaries. It also exposed each image’s configuration JSON, including environment variables, entrypoints, and full command history. That record handed ThreatDown the operation’s first command-and-control addresses, bot tokens, and the shared password for the operation’s own LLM gateway, all before any live host was touched. As ThreatDown put it, the compromised hosts kept pulling the implant from that same registry, “making it both the source of the evidence and the fleet’s update server.” As of September 3, 2026, six of the operation’s seven known registries, its phishing sites, its CDN, and its LLM gateway were all still online.

Five Steps From an Open Port to a Persistent Agent

ThreatDown’s writeup breaks Carbonato’s mechanism into five stages, and each one relies on infrastructure the operators did not have to build themselves.

Take and Hold the Host

Carbonato’s entry point is a Docker daemon reachable on port 2375 with no authentication required, the same class of misconfiguration that has powered Docker-targeting botnets before. Once the botnet finds one, it uses the exposed daemon API directly to launch a privileged container with the host’s filesystem mounted and access to its process and network namespaces. From inside that container, it runs nsenter against PID 1, the host’s own init process, joining its mount, UTS, network, and IPC namespaces to execute commands directly on the host rather than inside the container’s own boundary. The exposed daemon does all the work; nothing about this step requires an exploit.

Holding the host is handled by a script ThreatDown calls entry.sh. It opens a reverse SSH tunnel from the victim to a relay in Costa Rica, with the remote port deterministically derived from the MD5 hash of the victim’s own IP address, so the operators can recalculate the same port whenever they need to reconnect without maintaining a lookup table. The script installs its own SSH server and adds the crew’s key, then disguises the whole deployment as ordinary Linux infrastructure: the container runs under the name systemd-resolved and prints a fake “systemd-networkd resolver v2.0” banner, while its process arguments imitate the kernel thread [kworker/u2:0] to blend into a quick process listing. Persistence hooks land through cron, systemd timers, rc.local, and OpenRC, each one marked immutable, with paired watchdogs that re-pull the implant from the registry if its files or container ever disappear.

Install and Operate the Agent

With the host held, Carbonato installs Hermes Agent unchanged. As ThreatDown describes it, “the framework already accepts Telegram tasks, runs terminal commands, and connects to compatible LLM endpoints,” capabilities that “give the crew an operator interface on every compromised host without building its own agent framework.” The only modification is to the framework’s SOUL.md persona file, a 39-line prompt that directs the agent to execute tasks received through Telegram, maintain persistence, collect credentials, and store loot in a predictable location on disk with descriptive filenames.

Those standing instructions only activate once an operator sends a task. Hermes Agent receives it through Telegram and forwards it, along with the full SOUL.md persona, to the operation’s own LLM gateway. The persona sets the standing rules for that host; the operator supplies whatever the immediate task happens to be. What follows is, in ThreatDown’s own words, “an interactive command loop”: “The model interprets the task, writes terminal commands, reads the output, and decides what to do next,” the researchers explain. “The agent runs those commands on the victim and returns its report to the Telegram chat that also receives deployment reports.”

Spread

Carbonato is a worm. Persistence scripts scan every network attached to a compromised host every five minutes, looking for the next exposed Docker daemon on port 2375. Each new compromise repeats the same sequence: pull the implant from the registry, launch the same privileged container, enter the same persistence and scanning loop. No single host is a target. Every host is also a scanner.

The Mask, Not the Actor

The name of the file Carbonato overwrites is not incidental. The word persona derives from Latin, where it originally referred to a theatrical mask, one Latin etymologists trace to per/sonare, the mask through which an actor’s voice was meant to resound. Whatever Hermes Agent’s own designers had in mind when they named it, the file lives up to that etymology functionally: SOUL.md is the file that gives a running instance of the framework its identity, its instructions, its personality. Carbonato’s operators never touched the actor. They wrote a new mask and handed it to an actor that was already fully capable, already trusted by its legitimate users to do real work, and already reachable through six separate channels the framework ships with by default.

sxz.io profiled Hermes Agent’s design nine days before ThreatDown’s Carbonato report went public, in the context of a wider field of competing AI agent harnesses. That piece flagged the specific tradeoff Carbonato now demonstrates in the wild: a persistent, self-evolving identity like Hermes Agent’s promises compounding capability over time, but it is also harder to fully audit at any single point, since the thing being reviewed today may have rewritten its own prompts or skills by the time anyone checks again. Carbonato’s version of that risk is blunter than a self-evolving prompt drifting on its own. An attacker with host access simply overwrote the identity file outright. But the underlying exposure is the same one that piece identified: the file that makes a persistent agent valuable, the one carrying its accumulated rules and context, is also the smallest possible attack surface an operator needs to fully repurpose it.

It is also a different kind of AI-native malware than the other prominent example sxz.io has covered this month. Cisco Talos’s CLOSEDQUORUM, a Windows credential stealer that queries four commercial LLM providers and acts on whatever a plurality of them recommends, built its own decision-making apparatus from scratch: a custom orchestrator, a custom voting function, direct API calls to DeepSeek, Qwen, Mistral, and Gemini. Carbonato’s operators wrote none of that. They took an entire, already-built, already-popular agent framework and repurposed it with a text file. Talos’s own framing for CLOSEDQUORUM, an AI system handling “effort displacement” rather than just accelerating a human, applies here too, but Carbonato displaces even more effort than CLOSEDQUORUM did. It did not even need to displace the effort of writing an AI integration.

What the Persona Tells It to Prioritize

The instructions Carbonato’s operators wrote into SOUL.md are a small, honest window into what a financially motivated crew now considers most valuable to steal from a compromised Linux server. ThreatDown found the prompt explicitly ranks AI API keys ahead of SSH credentials, access tokens, databases, and every other credential type, naming 14 specific providers by name. The persona also directs the agent to report any exposed AI endpoints it finds, not just credentials, because, in the prompt’s own words, “they are vectors for more keys.” A stolen AWS key or database password buys an operator access to one system. A stolen AI provider key can be resold, rate-limited abuse can be laundered through someone else’s billing account, and, per Carbonato’s own design, it can bootstrap the exact same interactive access this botnet already runs on every other host it holds.

Attribution Points to Costa Rica

ThreatDown ties Carbonato to Costa Rica through three independent signals drawn from different parts of the operation. Fourteen of 162 recovered image configurations carry UTC-06:00 timestamps, matching the America/Costa_Rica timezone. The operation runs its Telegram channel under the handle Carbo506, and +506 happens to be Costa Rica’s own country calling code. The botnet’s reverse SSH tunnels also consistently land inside AS262145, a network registered in Costa Rica. Build configuration, operator identity, and live infrastructure each point the same direction independently, which is why ThreatDown treats the Costa Rica assessment as reasonably well supported rather than a guess from any single data point. The researchers were unable to tie Carbonato to any previously known threat cluster.

You Cannot Blocklist a Legitimate Package

ThreatDown’s own detection guidance opens with the same fact that makes Carbonato hard to write conventional signatures for: hermes-agent is a legitimate package with ordinary, non-malicious users. Blocking it outright, or flagging every host that runs it, would generate constant false positives against real Hermes Agent deployments doing exactly what the framework is designed to do. The guidance instead focuses on abuse signatures specific to this campaign: a /root/.hermes/SOUL.md file containing the string “GH0ST,” a .env file carrying a CARBONATO_API_KEY variable, and unexplained Telegram egress traffic from a server that has no legitimate reason to be talking to Telegram at all. Defenders are also told to look for the persistence kit directly: a hidden binary at /usr/local/bin/.docker-network-monitor, process arguments disguised as [kworker/u2:0], a cryptocurrency miner masquerading as /usr/sbin/systemd-logind, and immutable file attributes set on files that should never carry them.

Two pieces of the guidance are worth reading as an actual doctrine rather than a checklist. ThreatDown tells defenders to treat AI API keys like bank credentials, since Carbonato’s own persona already ranks them first: inventory where they live, rotate them on a schedule, and watch how they get used rather than treating them as a lower-priority secret than a database password. And the fix for the intrusion vector itself has nothing to do with AI at all. Do not expose a Docker daemon API to the open internet, and require authentication on every registry, because an unauthenticated API is Carbonato’s entire way in, and, as this incident shows directly, an open registry doubles as, in ThreatDown’s own phrase, “both a leak and a weapons dispenser” for whoever finds it next.

A Guardrail Problem With No Guardrail Yet

It is tempting to read Carbonato as proof that Docker’s new Sandbox Kit Specification, announced the same week this story broke, arrives exactly on time. That framing overstates the connection. The Kit Specification solves a permission problem: an agent already running inside a properly isolated Docker Sandbox that has been granted more network access or more credential reach than the task in front of it actually needs. Carbonato’s root cause is not an over-permissioned agent. It is a Docker daemon with no authentication at all, reachable directly from the internet, a misconfiguration a diffable OCI manifest does nothing to prevent, because there is no manifest, no boundary, and no review step anywhere in the chain that produced it.

What connects the two stories is not the fix. It is the shape of the problem both are responding to, from opposite ends. Docker engineer Christian Dupuis wrote, in the post announcing the Kit Specification, that agent permissions granted “one piece at a time” quietly take back isolation nobody meant to give up, and that none of it needs an exploit. Carbonato is the version of that same argument with the stakes raised past a permission slip: an entire host handed over, an entire legitimate agent framework repurposed, and not a single exploit required anywhere in the chain, only a port nobody closed. The industry is racing to build guardrails for agents running inside a boundary. Carbonato is a live demonstration that a host with no boundary at all is already enough to make any sufficiently capable, sufficiently trusted framework do exactly what a legitimate deployment would do, just for somebody else’s benefit.