Cloud security stories

Jul 17, 2026

NadMesh Botnet Harvests 3,800+ Cloud Credentials by Targeting Exposed AI Services

A Go-based botnet called NadMesh, discovered in early July 2026, is systematically scanning for and exploiting exposed AI services including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio to steal cloud credentials. The operator's dashboard claims to have collected 3,811 unique AWS keys along with Kubernetes tokens.

Jul 17, 20265 sources

May 20, 2026

U.S. Cybersecurity Agency CISA Exposed Sensitive AWS GovCloud Credentials in Public GitHub Repository

The Cybersecurity and Infrastructure Security Agency (CISA) left highly privileged AWS GovCloud credentials, passwords, and access keys exposed in plain text on a public GitHub repository maintained by a contractor for months. Security experts described it as one of the worst credential leaks they have witnessed.

May 20, 20268 sources

May 2, 2026

Anthropic Launches Claude Security Defensive Cybersecurity Tool

Anthropic released Claude Security to give cyber defenders access to AI capabilities for defensive purposes, drawing on offensive capabilities the company previously deemed too dangerous to release in another model.

May 2, 20261 source

Top claims

▪The NadMesh botnet operator's dashboard, analyzed by QiAnXin's XLab, claims the collection of 3,811 unique AWS keys.
▪The NadMesh botnet's central controller coordinates bots using HTTP APIs, seeding them with more than 90 cloud provider address ranges and falling back to random /24 ranges when the task queue is empty.
▪The NadMesh botnet deploys more than 20 exploitation vectors, including Kubernetes API abuse via pods with hostPath mounts and Docker API misuse to launch containers with host networking.

Subtopics

AI security3 AI privacy & surveillance2 AI tools & products2 AI safety & social impact1 Credential management1 Cybersecurity1 Government cybersecurity1

Related timelines