Executive Summary
ThreatDown reports the Carbonato botnet compromises exposed Docker daemons to deploy the open-source Hermes Agent framework, overwriting its SOUL.md persona file so the agent executes tasks received through Telegram.
What Happened
Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that's targeting exposed Docker daemons to deploy an open-source artificial intelligence (AI) agent framework called Hermes Agent. "The implant installs the framework unchanged, then overwrites its SOUL.md persona file," ThreatDown said. "The 39-line prompt directs it to execute tasks received through
Affected Products
- Docker
- Hermes Agent
Vulnerability / Attack Technique
Hijacking an AI agent framework via persona file overwrite
Technical Mechanism
The implant installs Hermes Agent unchanged, then replaces SOUL.md with a 39-line prompt instructing the agent to run tasks sent by the attacker over Telegram.
AI Security Category
LLM07:2025 System Prompt Leakage
Relevant Frameworks
RealGround Analysis
An agent's persona file is effectively its control plane. RealGround analysis: protect agent instruction files with the same integrity controls as code, and watch for agent frameworks appearing on hosts.
Recommended Controls
- Do not expose Docker daemons to the internet
- Make agent persona and instruction files read-only and monitor them for changes
- Alert on unexpected agent frameworks running on servers
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/carbonato-botnet-compromises-docker.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.