{
 "public_id": "AIR-2026-0160",
 "incident_id": "2026-07-xlab-nadmesh",
 "date_disclosed": "2026-07-12",
 "date_occurred": "2026-07",
 "title": "NadMesh botnet scans for exposed AI services and steals cloud keys, Kubernetes tokens and MCP tool access",
 "class": "in_the_wild",
 "attack_surface": "agent_framework",
 "initial_vector": "internet_scanning_of_unauthenticated_ai_services",
 "agent_capability_abused": [
  "mcp_tool_enumeration",
  "model_access",
  "host_credential_files"
 ],
 "target_product": "ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio",
 "target_vendor": "multiple",
 "autonomy_level": "assistant",
 "impact_realized": true,
 "impact_type": [
  "credential_theft",
  "infrastructure_compromise"
 ],
 "blast_radius": "Operator dashboard claimed 3,811 unique AWS keys; ~139 distinct source IPs pushing NadMesh daily by early July 2026",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI03",
   "ASI08"
  ],
  "mitre_atlas": [],
  "labels": [
   "ai_infrastructure",
   "botnet",
   "mcp_enumeration",
   "credential_theft"
  ]
 },
 "defense_present": "Most targeted services ship with no authentication by default",
 "defense_bypassed": true,
 "fix_shipped": null,
 "primary_sources": [
  "https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html"
 ],
 "verified_quote": "3,811 unique AWS keys",
 "confidence": "medium",
 "notes": "Analysis by QiAnXin XLab; the XLab writeup itself is not quoted here, so this is sourced from The Hacker News' reporting - medium confidence. The 3,811 figure comes from the attacker's own dashboard, which XLab notes is internally inconsistent (17,700 vs 95,700 deployments in adjacent counters), so treat it as an attacker claim. The genuinely new part is that it enumerates callable MCP tools on compromised hosts, i.e. it inventories agent capability, not just credentials.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Credential & Secret Theft",
  "Persistence & Covert C2"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "a botnet scans and steals keys from exposed AI services",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "internet_scanning_of_unauthenticated_ai_services",
 "guardrail_kind": [
  "authentication"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "unknown",
 "model_provider": "meta",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "impact rule: credential_theft",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (eai_category=credential_theft); ASI08 (signal=cascade)",
 "submitted_by": "EAI Internal"
}