Checked fact 18628 Sep 2026Research

It spreads by scanning for Docker hosts with an API exposed on port 2375 without authentication.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

Docker daemons that accept unauthenticated connections on port 2375

What the source said when we opened it, on 28 Sep 2026.

The source

CARBONATO: a botnet built around an AI agent
ThreatDown (Malwarebytes) · 2026-09-22

Open the source archived copy

Checked

Checked by the notis newsroom on 28 Sep 2026, against the source above.

In the story

ThreatDown says the CARBONATO botnet installs an unmodified Hermes Agent and targets AI API keys first. 28 Sep 2026

Cite this fact

Short permanent address

In a sentence

“It spreads by scanning for Docker hosts with an API exposed on port 2375 without authentication.” ai notis, checked 28 Sep 2026. Source: CARBONATO: a botnet built around an AI agent (ThreatDown (Malwarebytes)). https://ainotis.com/c/186

As a reference (APA style)

ai notis. (2026, September 28). It spreads by scanning for Docker hosts with an API exposed on port 2375 without authentication [Checked claim 186]. ai notis. https://ainotis.com/c/186

Anyone may quote this address. It does not change; if we correct the story, this page says so.