NadMesh Botnet — Mass Exploitation of Exposed AI Tooling for Credential Theft
First seen Jul 19, 2026 · Updated Jul 19, 2026
NadMesh is a Go-based botnet that scans the internet for unauthenticated, publicly exposed AI infrastructure (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) and abuses them to harvest cloud credentials, including a claimed 3,811 unique AWS keys, as well as Kubernetes tokens. This is not an attack on agent reasoning or protocols themselves, but exploitation of poor deployment hygiene around AI tooling that teams stand up quickly without adequate authentication or network controls. Severity is high because successful compromise yields direct cloud/infrastructure takeover, not just AI misuse.
Technical Analysis
The botnet operator runs a Shodan-driven harvester to continuously discover internet-facing instances of popular AI workflow and inference tools that are frequently deployed with default configurations, no authentication, or open management interfaces. Once identified, NadMesh likely leverages exposed API endpoints, workflow execution features (e.g., n8n workflows, ComfyUI/Gradio custom nodes, Langflow components), or file/config access to execute code or read local environment variables, config files, and cloud metadata services (e.g., AWS instance metadata) to extract IAM credentials and Kubernetes service account tokens. This crosses from the AI tool layer into cloud infrastructure and container orchestration control planes, converting a single exposed AI service into full cloud account or cluster compromise. The entry point is misconfiguration/exposure rather than a vulnerability in agent logic, but the impact chain (AI tool -> credential harvest -> cloud/K8s takeover) is a supply-chain-adjacent risk specific to how AI stacks are operationalized.
Affected Systems
ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio
Detection Signatures
- Unusual inbound scanning traffic against ports commonly used by ComfyUI, Ollama, Open WebUI, Langflow, Gradio, n8n
- Unauthenticated access attempts followed by workflow/job creation or custom node/script execution on these services
- Outbound requests from AI service hosts to cloud metadata endpoints (e.g., 169.254.169.254) shortly after inbound connection from unknown IPs
- Unexpected creation or use of new AWS IAM access keys shortly after AI service exposure
- Anomalous Kubernetes service account token usage originating from AI workload pods
- Go-binary artifacts or unfamiliar processes spawned by AI service user accounts
- High-volume Shodan-style reconnaissance patterns against internal/external IP ranges hosting AI tools
Remediation Steps
- 1
Eliminate unauthenticated exposure
Require authentication (API keys, OAuth, mTLS) on all AI tool UIs and APIs (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio); never expose management interfaces directly to the internet.
- 2
Network segmentation and firewalling
Place AI workflow/inference tools behind VPNs, bastion hosts, or private networks; restrict inbound access to known IP ranges and disable default open ports.
- 3
Restrict cloud metadata access
Enforce IMDSv2 and metadata service hop-limits on cloud instances; use scoped, short-lived IAM roles instead of long-lived static AWS keys stored in environment variables.
- 4
Lock down Kubernetes tokens
Apply least-privilege RBAC to service accounts used by AI workloads, disable automounting of service account tokens where not required, and rotate/monitor token usage.
- 5
Continuous exposure monitoring
Regularly scan your own external attack surface (Shodan, Censys) for exposed AI services and remediate findings before attackers do.
- 6
Credential rotation and monitoring
Rotate any AWS keys or tokens that may have been exposed, and enable CloudTrail/GuardDuty alerting for anomalous key creation or usage patterns.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.