A Docker botnet installs an off-the-shelf AI agent and tells it to take AI API keys first
ThreatDown documents CARBONATO as "a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable hosts, and gives operators a Telegram-controlled tool for post-compromise activity." The implant installs Hermes Agent, "an MIT-licensed, open-source framework from Nous Research," overwrites its SOUL.md persona file with a 39-line prompt that renames the agent GH0ST, and "directs the agent to collect AI API keys ahead of SSH credentials, access tokens, databases, and other credentials," naming 14 providers. Every five minutes it scans each attached /24 for Docker daemons exposed on port 2375.
One operator ran three open-source AI harnesses against online retailers at about $25 a company
Gambit Security's Eyal Sela reports a campaign running since July in which a single operator chained three agent harnesses bought through OpenRouter — Strix for vulnerability search (GLM 5.2, later DeepSeek v4 Pro), Cairn for exploitation (DeepSeek v4.1 Flash) and the open-source Hermes agent for orchestration (Anthropic's opus-4.6). “Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees,” including at least 600,000 unexpired credit card details from two of them; “skimmers were ordered against at least 27 named victims and confirmed in place on 19 of them.” The operator's own cost review gives “a mean of $25.46 over 101 completed scans,” against about $7,006 of model spend in four weeks. Gambit names no operator and says errors are possible at this stage of the analysis.
A repository's own git config makes seven AI coding agents run attacker code before any prompt
Manifold Security reports eight findings across seven AI coding agents in which a repository's git configuration names a command that git then executes on the host, with the user's privileges, before any trust prompt, because agents run git commands at session start to gather context. The named vector is the core.fsmonitor setting; Claude Code, Goose, OpenAI Codex and Cursor shipped fixes while Qwen Code, Grok Build, Hermes Agent and a second Claude Code path were unpatched at publication. The write-up states two CVEs, CVE-2026-72718 for Goose and CVE-2026-71963 for Hermes, and says delivery requires the repository to arrive as files with its .git directory intact rather than through a clone.
Israeli firm Dream reports China-linked operators ran a near-autonomous AI-agent intrusion of Taiwan's government
Israeli cybersecurity firm Dream reported that suspected China-linked operators used open-source AI-agent frameworks — it names Hermes and OpenClaw — to run a largely autonomous intrusion of Taiwanese government systems, compromising at least 85 accounts, taking more than 2,500 personnel records (a roughly 160 MB, ~1,400-file archive), and probing a nuclear-safety agency, the government email system and at least seven energy-sector companies. Taiwan's Administration for Cyber Security confirmed the attacks originated overseas and combined conventional hacking with AI agents including OpenClaw; Dream said the tool adapted mid-operation through autonomous “Learning Cycles” but that the operation still required significant human work.
Unit 42 reports Chinese-speaking actor running autonomous attacks with DeepSeek and the Hermes Agent framework
Palo Alto Networks Unit 42 documented a Chinese-speaking threat actor using aliases knaithe and KnYuan who wired DeepSeek into the Hermes Agent framework and orchestrated it over Telegram to autonomously enumerate vulnerabilities, source exploits and launch attacks, including FOFA-driven scanning for exposed Langflow and n8n instances. The autonomous exploitation attempts failed against authenticated targets, and the actor's successful compromises came from manual operations; OpenAI confirmed its provider-side safeguards refused policy-violating requests and disabled an account it believes is linked to the campaign.
Open-source Hermes agent run in "YOLO mode" automated an intrusion at Thailand's finance ministry
Hunt.io and researcher Bob Diachenko found exposed attacker infrastructure — 585 files, roughly 470 MB — whose logs show the open-source Hermes AI agent instructed to escalate privileges, scan for kernel vulnerabilities, enumerate services and traverse file systems, running in a mode that removes the human approval prompt before dangerous commands. Thailand's Ministry of Finance has not confirmed a breach, and some artefacts show systems targeted rather than compromised.