Cloud security stories

Jul 17, 2026

NadMesh Botnet Harvests 3,800+ Cloud Credentials by Targeting Exposed AI Services

A Go-based botnet called NadMesh, discovered in early July 2026, is systematically scanning for and exploiting exposed AI services including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio to steal cloud credentials. The operator's dashboard claims to have collected 3,811 unique AWS keys along with Kubernetes tokens.

Jul 17, 2026·5 sources

May 20, 2026

U.S. Cybersecurity Agency CISA Exposed Sensitive AWS GovCloud Credentials in Public GitHub Repository

The Cybersecurity and Infrastructure Security Agency (CISA) left highly privileged AWS GovCloud credentials, passwords, and access keys exposed in plain text on a public GitHub repository maintained by a contractor for months. Security experts described it as one of the worst credential leaks they have witnessed.

May 20, 2026·8 sources

May 2, 2026

Anthropic Launches Claude Security Defensive Cybersecurity Tool

Anthropic released Claude Security to give cyber defenders access to AI capabilities for defensive purposes, drawing on offensive capabilities the company previously deemed too dangerous to release in another model.

May 2, 2026·1 source

Top claims

▪The NadMesh botnet operator's dashboard, analyzed by QiAnXin's XLab, claims the collection of 3,811 unique AWS keys.
▪The NadMesh botnet's central controller coordinates bots using HTTP APIs, seeding them with more than 90 cloud provider address ranges and falling back to random /24 ranges when the task queue is empty.
▪The NadMesh botnet deploys more than 20 exploitation vectors, including Kubernetes API abuse via pods with hostPath mounts and Docker API misuse to launch containers with host networking.

Subtopics

AI tools & products AI security AI privacy & surveillance Credential management Government cybersecurity

AI safety & social impact

Cybersecurity

Related timelines

Cloud security stories

NadMesh Botnet Harvests 3,800+ Cloud Credentials by Targeting Exposed AI Services

U.S. Cybersecurity Agency CISA Exposed Sensitive AWS GovCloud Credentials in Public GitHub Repository

Anthropic Launches Claude Security Defensive Cybersecurity Tool

Related timelines

US Congress

Venture capital funding

Iran War

Strait of Hormuz blockage

Trump administration