A new autonomous botnet named NadMesh is scanning the public internet for exposed AI development services, then using more than 20 exploitation vectors against Redis, Docker, Kubernetes, and MCP tooling to harvest cloud access keys and Kubernetes service-account tokens, according to research published by QiAnXin’s XLab team.

XLab found that NadMesh runs an autonomous scanning engine covering more than 90 cloud provider address ranges and gives its highest scan priority to AI infrastructure discovered through Shodan, specifically ComfyUI, Ollama, Gradio, n8n, Open WebUI, and Langflow instances left reachable from the open internet. Once it gets in, it goes after AWS credentials, Kubernetes tokens carrying cluster-admin privileges, and MCP tool configurations capable of arbitrary SQL or shell execution, then persists through SSH backdoors, cron watchdogs, and independent agent processes so that removing one foothold does not clear the host. XLab describes the operation as commercial-grade rather than opportunistic, built around a web-based management panel with conversion tracking behind it.

The pattern lines up with what CyberTech has already flagged in AI agent infrastructure: teams stand up inference servers, agent frameworks, and MCP endpoints fast, often outside the review process that would catch a conventional server left open to the internet, and attackers are starting to build tooling specifically for that gap rather than repurposing generic botnet scanners. CyberTech covered a related trust-boundary weakness in AI agent platforms earlier this month; NadMesh is the network-perimeter version of the same underlying problem, where the AI stack is getting deployed faster than it is getting inventoried as an attack surface.

Security teams running any of the targeted platforms should confirm none of them are reachable from the public internet without authentication, rotate cloud and Kubernetes credentials accessible from those hosts, and add AI development tooling to routine external-exposure scans rather than treating it as a one-off deployment.

Source: QiAnXin XLab