One criminal operation has started putting an AI agent inside the servers it takes over. Security company ThreatDown describes a botnet called Carbonato that breaks into poorly protected Docker installations and installs an open-source AI agent there. The operators then send it tasks in plain language.
Docker is widely used software for running applications in isolated containers. Carbonato targets servers where Docker's control interface was left open to the internet without a password.
Why it matters
Until now, a botnet needed custom code for every command it could run. Here the operators skipped that work. According to ThreatDown, the AI agent reads each task, decides which commands to run, looks at the results and reports back, so the criminals get a flexible remote worker on every infected machine.
The same agent frameworks that companies use to automate their own work are now doing the same for attackers.
What the researchers found
ThreatDown traced activity back to October 2024 and found an unprotected storage server of the operators holding 59 software repositories. The malware spreads to other unprotected Docker servers on nearby networks and hides so that removing it once is not enough.
The operators used the agent mainly to hunt for valuable data such as access keys and passwords.
How to stay safe
The fix is basic hygiene. ThreatDown's advice: "Do not expose the Docker daemon API to the network, and require authentication on every registry." Administrators can also check their servers for the indicators ThreatDown published in its report.
