Here's a sentence I never thought I'd write in 2026: the biggest threat to your cloud account might be your own ComfyUI install. Not a leak at AWS. Not a supply-chain attack on some megacorp. Your node-based image generator, sitting on port 8188 with no password, has quietly become a door into your entire cloud setup — and a new botnet called NadMesh is walking straight through it.
I've run ComfyUI on more machines than I care to count. I've left the default port open, told myself "it's just for local generation," and moved on. If that sounds familiar, keep reading. This one is aimed at us.
What NadMesh Actually Is
NadMesh is a botnet written in Go, first flagged by QiAnXin XLab in early July 2026 and picked up by The Hacker News within days. It's not a script-kiddie toy. Security researchers describe it as industrial-grade — built like a product, with obfuscation, packing, and random data padding that gives every infected sample a unique checksum so traditional signature-based detection barely lands a hit.
It hunts for victims the way a recruiter hunts for talent: aggressively, and everywhere. The botnet scans the internet through Shodan, then drills into subnets where it has already found accessible services. XLab's sensors logged a sharp spike in activity in the first week of July — roughly 139 source IPs per day, which tells you this thing scales like a business, not a hobby.
The Target List Reads Like My Own Toolbox
Here's the part that made me actually go check my firewall rules. NadMesh is specifically looking for AI services that were deployed in a hurry and left exposed:
- ComfyUI on port 8188 — the default, wide open
- Ollama on port 11434, one of the most common local-model setups on earth
- Gradio apps on 7860 and n8n automation on 5678
- Open WebUI, Langflow, and other unauthenticated AI panels
It doesn't stop at AI panels, either. The botnet packs more than 20 remote code execution vectors, and the bulk of its recorded attempts target exposed Docker APIs and Jenkins consoles. It also brute-forces weak Telnet passwords and pokes at Redis. In other words: anything with no password and a network cable is fair game.
Once inside, it goes credential hunting. NadMesh digs through environment variables, .env files, ~/.aws/config, and ~/.docker/config.json, extracting AWS access keys and Kubernetes service tokens. The operator panel claims 3,811 unique AWS keys stolen — and while researchers note the dashboard counters contradict each other, even a fraction of that number is a nightmare. Each stolen key is a potential path to billing, data, and compute that someone else is paying for.
Why I Think We're Asleep at the Wheel
Here's my unpopular opinion: the AI community built this problem and has refused to pay the bill. Open-source AI exploded because it was easy — download, run, generate. But "easy" became "no authentication by default," and "no authentication by default" became a goldmine for people who scan the entire internet every few minutes looking for exactly that.
The MCP angle makes me even more nervous. NadMesh has already been observed using Model Context Protocol tooling to execute commands remotely — less than 0.78% of attempts so far, but the fact that it's there at all tells you where this is heading. We're wiring agentic AI to command execution, and a botnet is already reading the manual.
So what do we do? It's boring, but it works. Put authentication on your ComfyUI and Ollama instances. Close ports 8188, 11434, 7860, and 5678 to the public internet. Stop putting real AWS keys in .env files on machines with open panels. If you've been hit, isolate the machine, wipe persistence mechanisms, revoke every credential the malware could have touched, and check your SSH keys, temp directories, and cron jobs.
Here's my thesis, and I'll die on this hill: openness isn't the bug. The bug is pretending that open means harmless. NadMesh isn't an argument against local AI — it's an argument for growing up about it. Your ComfyUI server is a tool, and like every tool connected to the internet, it needs a lock. The good news is the fix is simple. The bad news is most of us haven't done it yet.
Comments