Langflow stories

Jul 17, 2026

NadMesh Botnet Harvests 3,800+ Cloud Credentials by Targeting Exposed AI Services

A Go-based botnet called NadMesh, discovered in early July 2026, is systematically scanning for and exploiting exposed AI services including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio to steal cloud credentials. The operator's dashboard claims to have collected 3,811 unique AWS keys along with Kubernetes tokens.

Jul 17, 2026·5 sources

Jul 2, 2026

JADEPUFFER: First Fully Autonomous AI Agent Executes Complete Ransomware Attack

Security firm Sysdig documented what researchers believe is the first ransomware attack conducted entirely by an AI agent without human intervention. The operation, dubbed JADEPUFFER, exploited a Langflow vulnerability and autonomously performed reconnaissance, credential theft, lateral movement, and data encryption.

Jul 2, 2026·9 sources

Top claims

▪The NadMesh botnet operator's dashboard, analyzed by QiAnXin's XLab, claims the collection of 3,811 unique AWS keys.
▪The NadMesh botnet's central controller coordinates bots using HTTP APIs, seeding them with more than 90 cloud provider address ranges and falling back to random /24 ranges when the task queue is empty.
▪The NadMesh botnet deploys more than 20 exploitation vectors, including Kubernetes API abuse via pods with hostPath mounts and Docker API misuse to launch containers with host networking.

Topics

Cloud security AI tools & products AI security AI privacy & surveillance AI existential risk (x-risk)

AI agents

AI safety & social impact

Autonomous Systems

Related entities

Cybersecurity

Featured Stories

OpenAI pauses development of Astra AI model over critical cybersecurity capability concerns

Aug 7, 2026·2 sources