Executive Summary
NadMesh is a Go-compiled botnet framework first documented in July 2026 that specifically targets internet-exposed AI and machine learning service endpoints. The botnet integrates over 20 exploit chains covering commonly deployed AI tools including Ollama, ComfyUI, n8n, Langflow, Gradio, Open WebUI, and LocalAI, automating the complete attack lifecycle from Shodan-powered discovery to credential exfiltration without human operator involvement at the execution stage.
The operator’s claims, partially corroborated by researchers who found credential batches on underground forums, include over 3,811 harvested AWS access keys from environments running exposed AI services. The mechanism is straightforward: AI services run in containers or VMs that are frequently provisioned with cloud provider credentials to access storage, models hosted on S3, or other cloud resources. Attacking the exposed AI service endpoint provides a path to those credentials.
NadMesh’s significance is not technical sophistication. Individual exploit chains are adaptations of known public vulnerabilities. What is notable is the systematic assembly of AI-specific attack surface into a single automated framework, and its deployment at scale against a target category that has grown rapidly and absorbed limited security attention. The botnet represents the transition of AI infrastructure targeting from opportunistic to industrialised.
Architecture
NadMesh is written in Go with a mesh-based command and control architecture that does not use a single centralised C2 server. Compromised nodes participate in a distributed peer-to-peer network where tasks are distributed across the mesh and results are aggregated through relay nodes before reaching the operator. This architecture makes takedown harder than single-server C2 and provides some degree of attribution protection by distributing traffic across many IPs.
The exploit module set is compiled into the binary as a library of attack chains with a common interface. A discovery module handles Shodan API queries to identify targets by service fingerprint, port, and banner patterns. When a target is identified, the exploit module for the corresponding service is invoked, the attack is executed, and results including extracted credentials, configuration data, and access tokens are passed back through the mesh.
The Go compilation provides cross-platform compatibility, and researchers found NadMesh binaries compiled for Linux/amd64, Linux/arm64, and Linux/arm, covering the full range of architectures on which AI services are commonly deployed. Cloud VMs running AMD64, Raspberry Pi nodes hosting local AI, and cloud-native ARM instances are all in scope.
The Target Set
The choice of target services is deliberate and reflects the specific attack surface profile of the AI deployment ecosystem.
Ollama (port 11434) is the most widely deployed local and self-hosted LLM runtime. It was not designed as a network service, lacks authentication by default, and a substantial portion of deployments have port 11434 exposed to the internet. Ollama’s CVE-2026-7482 (Bleeding Llama, disclosed the same week as NadMesh) is one of the exploit chains in NadMesh’s module library. Additionally, Ollama’s API provides model management capabilities including model upload, which NadMesh abuses to submit crafted model files that exploit secondary vulnerabilities.
ComfyUI is the dominant node-based UI for Stable Diffusion image generation workflows. It provides a web interface and an API that is similarly unauthenticated by default. ComfyUI installations frequently run on systems with GPU hardware and associated cloud integrations for model storage. The attack chain in NadMesh exploits a custom node execution path that allows arbitrary Python execution via the workflow API.
n8n (port 5678) is an open-source workflow automation platform with broad adoption for AI pipeline orchestration, connecting LLM APIs to external services and data sources. Exposed n8n instances with default or absent authentication provide workflow execution capabilities that NadMesh abuses to execute system commands via n8n’s Execute Command node.
Langflow (port 7860) has been under sustained exploitation throughout 2026 via CVE-2025-3248, an unauthenticated RCE in the code validation endpoint. NadMesh includes this exploit chain and additional Langflow-specific chains. The JADEPUFFER agentic ransomware campaign documented separately also uses this vulnerability, indicating Langflow has become a high-value target category for multiple threat actors simultaneously.
Gradio is used to deploy machine learning demos and interfaces. Its share functionality and API endpoints have a documented history of vulnerabilities allowing path traversal and file system access. NadMesh’s Gradio module targets older Gradio versions still widely deployed in research and demo environments.
The full list of targeted services extends to Open WebUI, LocalAI, AnythingLLM, Flowise, and several others. The pattern across all of them is the same: tools that prioritise ease of deployment and local use, deployed on internet-accessible hosts without the security configuration appropriate for public-facing services.
Credential Harvesting and Cloud Impact
The primary monetisation path for NadMesh appears to be cloud credential theft, not ransomware or traditional botnet activities like spam or DDoS. This reflects the specific economic profile of the target environment.
AI service deployments frequently sit in cloud environments with attached IAM credentials. Reasons include model weight storage on S3 or equivalent, API keys for hosted LLM services (OpenAI, Anthropic, Mistral), cloud database connections for vector stores, and deployment pipeline credentials. These credentials end up in the environment where the AI service runs, either as environment variables, mounted secret files, or in the cloud provider’s instance metadata service.
NadMesh’s post-exploitation module systematically retrieves credentials from these locations. It checks environment variables for common credential patterns, reads credential files from default locations (~/.aws/credentials, ~/.config/gcloud/, service account key files), and queries the instance metadata service at 169.254.169.254 (AWS) and equivalent endpoints for other providers to retrieve instance profile credentials.
The 3,811 AWS key claim, if accurate, represents a substantial volume of potentially active cloud credentials. Researchers found credential batches matching this description on a dark web forum, though verification of which are active versus expired was not fully possible at time of disclosure. Even a fraction of that number being live IAM credentials with meaningful permissions represents significant downstream risk.
Why AI Services Are an Under-Secured Target Category
The common thread across NadMesh’s target set is a deployment pattern that prioritises getting AI capabilities running over security configuration. The tools themselves are not inherently insecure. Ollama, Langflow, n8n, and ComfyUI all have configuration options for authentication, access control, and network binding. The issue is that their default configurations assume local use, and operators deploying them for remote access or on cloud infrastructure frequently skip the security configuration steps.
The ecosystem grew extremely fast. Between 2023 and 2026, the number of self-hosted AI service deployments went from niche developer experiments to a substantial installed base spanning research organisations, startups, enterprises running internal AI tools, and hobbyists. The security practices around these deployments did not keep pace. The result is a large attack surface with a consistent vulnerability profile that NadMesh systematically enumerates and exploits.
NadMesh’s Shodan integration makes this efficient. Rather than requiring operator-driven targeting, the botnet autonomously queries Shodan for known fingerprints of each target service, extracts the IP and port, and queues the target for exploitation. The operator’s role is to maintain the framework and collect the output. The actual attack execution is automated.
Detection and Response
For exposed AI services: Audit your external attack surface for AI service endpoints. Scan your public IP ranges for ports 11434, 5678, 7860, 8080, 3000, and other default ports for AI tools. Any AI service reachable from the public internet without authentication is a priority remediation target.
For credential exposure: Check your running AI service containers for environment variables containing cloud credentials. Credentials should not be in environment variables or plaintext files in AI service containers. Use IAM roles, workload identity, or mounted secrets with appropriate access controls.
For detection: Monitor for outbound connections from AI service hosts to unknown external IPs, unexpected process spawning from web server processes, and file access outside of model storage directories. NadMesh’s Go binary will show up as an unusual process on hosts that do not normally run standalone executables from unexpected paths.
For remediation: Bind AI services to localhost and use authenticated reverse proxies for external access. Enable whatever authentication mechanisms the tool provides. Apply available security patches. Rotate any cloud credentials that may have been exposed in environments where AI services were internet-accessible.
The NadMesh campaign reflects an attacker community that has identified AI infrastructure as a productive target category and built systematic tooling to exploit it at scale. The correct response is to apply to AI service deployments the same access control and credential hygiene standards that apply to any other internet-facing service, which historically has not happened.