Chronicle/Attacks & incidents

ThreatDown finds Carbonato, a Docker botnet that installs an AI agent to run operators’ tasks

Sep 22, 2026AttackMalwareSignificance assistant-drafted

ThreatDown reports a botnet that compromises Docker hosts with unauthenticated APIs, installs the open-source Hermes Agent framework with a replaced persona file, and has the agent carry out tasks sent over Telegram, including collecting AI API keys and other credentials. ThreatDown recovered the operation's toolchain from an exposed registry, with images dating from October 2024 to August 2026, and describes the agent reading command output and deciding next steps in an operator-driven loop.

Why it matters

It shows an off-the-shelf agent framework used as a botnet implant, with AI API keys treated as a primary theft target.

Key facts

As stated in the sources, with where to find them.

The exposed registry held 59 repositories, 234 image tags and 4.3 GB of image data.Findings table
The agent’s prompt directs it to collect AI API keys from 14 providers ahead of SSH credentials and access tokens.Findings table
Scripts, not the agent, spread the botnet by scanning attached networks for exposed Docker daemons. ThreatDown did not attribute it to a known cluster but assesses the operators as likely in Costa Rica.Article body; BleepingComputer

Findings that cite this record

Aug 27, 2025

Attackers have used AI agents to carry out much of the work of real intrusions, from reconnaissance to credential theft and extortion, with people directing them at a few decision points.

Corroboratedobserved5 evidence records

Nov 5, 2025

Malware that queries a language model during execution to generate commands has been used in live operations, including by a state-backed group; self-rewriting variants have been seen only in testing.

Corroboratedobserved2 evidence records

Key questions this bears on

How are attackers using AI agents in real operations?Increasingly to run parts of intrusions: providers and vendors report agent-driven espionage, extortion and credential theft, and malware that queries LLMs.

Sources

CARBONATO: a botnet built around an AI agent (page dated September 22; metadata says September 23)ThreatDownSep 22, 2026Primary sourceAccessed Sep 25, 2026
New Carbonato malware uses AI agents to hijack exposed Docker hostsBleepingComputerSep 24, 2026Secondary sourceAccessed Sep 25, 2026

Related records

Jul 1, 2026

Sysdig documents JADEPUFFER, a database-extortion intrusion it says an LLM agent ran end to end

AttackIncidentSysdig, JADEPUFFER

May 11, 2026

Google Threat Intelligence reports the first criminal zero-day exploit it believes was AI-developed, disrupted before planned mass use

AttackMisuse reportGoogle Threat Intelligence Group, UNC6780 (TeamPCP)

Aug 27, 2025

Anthropic reports Claude Code used to run a data-extortion campaign against at least 17 organizations

AttackMisuse reportAnthropic

Organizations: ThreatDown
Topics: AI malware AI-enabled intrusion
Methods: Malware that queries an LLM at runtime
Record: threatdown-carbonato-agent-botnet-2026 · added 2026-09-25

Cite this record

Fide AI. "ThreatDown finds Carbonato, a Docker botnet that installs an AI agent to run operators’ tasks." Agentic Cyber Explorer, record threatdown-carbonato-agent-botnet-2026. https://agentic-cyber-explorer.pages.dev/events/threatdown-carbonato-agent-botnet-2026/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-threatdown-carbonato-agent-botnet-2026,
  author = {{Fide AI}},
  title = {ThreatDown finds Carbonato, a Docker botnet that installs an AI agent to run operators’ tasks},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/threatdown-carbonato-agent-botnet-2026/},
  note = {Record threatdown-carbonato-agent-botnet-2026; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.