From a Docker Ping to an AI Command Plane: Inside the Hermes Attack Workbench and Carbonato Model Gateway — Part 2: Operations | TrendAI (US)

Trend Micro researchers analyzed how an attacker used AI agents and the Carbonato model gateway to coordinate offensive tasks and maintain a reusable skill library. A persistent parent session managed 29 delegated workers across multiple waves to probe exposed infrastructure like Docker honeypots and databases. The setup allowed the attacker to switch AI models independently of the execution environment while preserving operational knowledge through agent-created skill packages. Open article →