Researchers uncovered a botnet, dubbed Carbonato, that breaks into Docker daemons left exposed without authentication and installs an open-source AI agent framework, renamed ‘GH0ST,’ to run the intrusion. The agent interprets free-form instructions sent over Telegram, independently enumerates each compromised host, and decides whether to deploy cryptomining payloads or lateral-movement tools based on the host’s value, prioritizing theft of AI provider API keys. Evidence recovered from an exposed registry used by the operators indicates the campaign has run since at least October 2024.