Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent

Cybersecurity researchers disclosed a new botnet malware called Carbonato that targets exposed Docker daemons to deploy an open-source AI agent framework called Hermes Agent. The implant installs the framework unchanged, then overwrites its SOUL.md persona file with a 39-line prompt directing it to execute tasks received through Telegram.