API Key Security

API key security refers to practices and controls that protect API credentials from unauthorized access, theft, or misuse. In enterprise environments, exposed API keys can provide attackers direct access to sensitive systems and data, making them a critical target for security breaches. Organizations must implement proper key management, rotation schedules, encryption, and monitoring to prevent keys from being hardcoded in applications, committed to version control repositories, or logged in plaintext.

1 item

ResearchGlobal2026-09-24

Carbonato Malware Turns AI Agent Frameworks Into Attack Infrastructure

A new malware campaign named Carbonato targets exposed Docker daemon APIs to install the Hermes Agent AI framework on compromised hosts. The deployed agent, configured as a persona called GH0ST, accepts operator commands via Telegram, autonomously writes terminal commands, and harvests AI API keys and credentials. Malwarebytes ThreatDown identified the campaign as an active, global threat to enterprise AI infrastructure.

Carbonato Hermes Agent AI agent abuse malware credential theft Docker security agentic AI API key security