In the wild
Realized harm
NadMesh botnet scans for exposed AI services and steals cloud keys, Kubernetes tokens and MCP tool access
AIR-2026-0160 AIR record · 2026-07-xlab-nadmesh
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
3,811 unique AWS keysthehackernews.com
The record
Disclosed
2026-07-12
Occurred
2026-07
Vendor
multiple
Product
ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio
Risk domain
Access control and permissions › Credential theft
System type
Generative model
Who acted
AI was the target — a botnet scans and steals keys from exposed AI services
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Internet scanning of unauthenticated ai services
Impact type
Credential theft, Infrastructure compromise
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Operator dashboard claimed 3,811 unique AWS keys; ~139 distinct source IPs pushing NadMesh daily by early July 2026
Capability abused
Defense & remediation
Recorded defense
Most targeted services ship with no authentication by default
Guardrail kinds
Authentication
Guardrail outcome
Silent
Taxonomy & references
Curator notes
Analysis by QiAnXin XLab; the XLab writeup itself is not quoted here, so this is sourced from The Hacker News' reporting - medium confidence. The 3,811 figure comes from the attacker's own dashboard, which XLab notes is internally inconsistent (17,700 vs 95,700 deployments in adjacent counters), so treat it as an attacker claim. The genuinely new part is that it enumerates callable MCP tools on compromised hosts, i.e. it inventories agent capability, not just credentials.
Cite as
Enkrypt AI. "NadMesh botnet scans for exposed AI services and steals cloud keys, Kubernetes tokens and MCP tool access". AIR, AIR-2026-0160. https://agentincident.vercel.app/i/AIR-2026-0160/ (accessed 2026-10-19).