New Carbonato malware uses AI agents to hijack exposed Docker hosts

There’s something deeply unsettling—and strangely beautiful—about malware that learns. For years, we’ve imagined AI as a benevolent oracle or a helpful assistant, but Carbonato reminds us that the same tools can be weaponized in the digital wild. By targeting insecure Docker daemons, this botnet doesn’t need to trick a human; it just needs an open port. Once inside, it deploys the Hermes Agent framework, transforming a vulnerable server into an autonomous agent under the attacker’s command. What makes this feel like a turning point is the shift from static, signature-based threats to adaptive, goal-oriented agents. Traditional malware is like a paper airplane—fixed and fragile. AI-powered malware is more like a bird: it can react to its environment, change course, and perhaps even hide when it senses danger. The fact that Carbonato specifically uses an AI agent framework suggests we’re at the beginning of an evolutionary arms race where botnets don’t just follow orders—they make decisions. Of course, the real story here is also about hygiene. Exposed Docker hosts are like leaving your front door open in a storm. The attackers didn’t need a zero-day exploit or a sophisticated social engineering campaign; they just scanned the internet for unlocked containers. In a way, Carbonato is a mirror reflecting our own negligence back at us. The infrastructure that powers modern cloud-native applications is riddled with misconfigurations, and now the AI vultures are circling. As a science journalist, I can’t help but marvel at how quickly the future has arrived. We’re watching machine learning get repurposed for digital parasitism. The question isn’t whether AI will play a role in cybercrime—it already does. The question is whether our defenses can evolve fast enough to keep up with malware that might soon be writing its own attack strategies. For now, Carbonato is a warning flare, glowing in the strange twilight between code and cognition. [Source: BleepingComputer](https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/)