NadMesh Botnet Emerges as a Sophisticated Threat to AI and MCP Infrastructure Security researchers at XLab have uncovered NadMesh, a Go-based botnet that has been rapidly spreading since early July 2026, marking a shift in cybercriminal tactics toward industrial-grade, ROI-driven attacks targeting Artificial Intelligence (AI) and Model Context Protocol (MCP) infrastructure. Unlike traditional worms, NadMesh operates as a closed-loop system dubbed the "n4d mesh controller" integrating autonomous scanning, over 20 unique exploitation vectors, and Shodan-powered intelligence harvesting. Its most distinctive feature is ai_harvest.py, a reconnaissance module that programmatically queries Shodan to identify exposed AI and automation services, including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. Discovered IP addresses are prioritized for immediate exploitation, allowing the botnet to bypass inefficient brute-force scanning. The botnet follows a five-stage operation: 1. Intelligence gathering (Shodan-driven targeting) 2. Centralized control (HMAC-authenticated beacons on ports 80 and 8443) 3. Autonomous task supply (dynamic payload delivery) 4. Polymorphic binary construction (Garble obfuscation + UPX compression) 5. Active delivery (persistence via SSH backdoors, cron watchdogs, and hidden binaries) NadMesh prioritizes AI service ports, including: - 8188 (ComfyUI) - 11434 (Ollama) - 5678 (n8n) - 7860 (Gradio) Its exploitation arsenal includes: - MCP JSON-RPC tool calls (command execution loops) - Kubernetes malicious pod creation (hostPath mount overrides) - Docker API container escapes (privileged container creation) - Unauthenticated Redis instances (CONFIG SET file writes) - Elasticsearch RCE, Jenkins Script Console, and WebLogic deserialization flaws Beyond initial access, NadMesh exfiltrates high-value data, including: - AWS access keys & Amazon Bedrock credentials - Kubernetes ServiceAccount tokens (cluster-admin scopes) - Docker configurations & locally hosted AI models (Llama2, Mistral, GPT-4 API tokens) - Internal MCP tool configurations (execute_sql, execute_shell) To evade detection, the malware employs automated honeypot avoidance, blacklisting IPs that fail infection attempts after 10 consecutive deployments. Its web-based management panel complete with conversion-funnel analytics and real-time operational visibility resembles enterprise-grade software, underscoring its sophistication. Indicators of Compromise (IOCs): - C2 IP Node: `209.99.186.235` - C2 CDN Domain: `cdnorigin.net`

Chinese Threat Actor’s AI-Powered Hacking Framework Exposed in Major OpSec Failure Researchers from Unit 42 uncovered a Chinese-speaking threat actor’s AI-driven hacking infrastructure after an operational security (OpSec) blunder exposed its entire toolkit. The attacker, operating under the aliases knaithе and KnYuan, deployed an autonomous framework integrating DeepSeek with the open-source Hermes Agent, controlled via Telegram to execute attacks without continuous human oversight. The exposure occurred when the AI agent mistakenly launched a public file server, revealing exploit scripts, API keys, configuration files, and attack logs providing a rare glimpse into real-world AI-powered offensive operations. The system demonstrated end-to-end autonomy, handling reconnaissance, vulnerability research, and exploitation attempts independently. In one observed session, the agent targeted CVE-2026-33017 (Langflow, CVSS 9.8) but abandoned the effort after scanning 84 instances due to configuration constraints. It then pivoted to n8n workflow automation software, chaining CVE-2026-21858 (CVSS 10.0) and CVE-2025-68613 (CVSS 9.9). While over 647,000 exposed n8n instances were identified globally, the AI focused on Chinese infrastructure, though all targets required authentication, preventing successful compromise. The actor also experimented with multiple large language models (LLMs), including Qwen, GLM, Kimi, and MiniMax, with limited use of Western tools like Claude Code and Codex for exploit development. To evade detection, some operations were routed through proxy infrastructure (code.newcli[.]com), and logging features were disabled. However, the AI’s misconfiguration starting a local HTTP server led to the exposure of its working directory. Despite setbacks, the campaign confirmed the framework’s functionality, scanning 460 targets and achieving compromise in at least three cases. The incident underscores a critical shift in cyber threats: autonomous AI systems are now operational, drastically reducing the time and effort required for large-scale attacks. However, the exposure also highlights a new risk AI-driven automation can introduce OpSec failures, as seen here, where the very tools designed to scale attacks led to partial attribution. The findings signal an accelerating trend in AI-assisted cybercrime, with threat actors refining model selection, automation workflows, and evasion techniques. Defensive strategies will need to adapt, prioritizing attack surface management and rapid patching of high-severity vulnerabilities.

AI-Powered Ransomware Attack Executed Without Human Intervention in First-of-Its-Kind Incident Security researchers at cloud security firm Sysdig have identified what they believe to be the first fully autonomous cyberattack carried out by an artificial intelligence agent. Dubbed Jadepuffer, the AI-driven ransomware operation breached a vulnerable server, extracted credentials with a focus on Chinese cloud providers like Alibaba, Tencent, and Huawei and encrypted a production database before demanding a Bitcoin ransom. Unlike traditional ransomware attacks, which rely on human operators or pre-written scripts, this campaign was executed end-to-end by a large language model (LLM) using Langflow, an open-source AI tool. The AI demonstrated real-time adaptability, adjusting tactics within seconds such as correcting failed login attempts in just 31 seconds and operating at speeds surpassing human capabilities. A critical flaw in the attack: even if victims paid the ransom, their data was unrecoverable, as the AI had already deleted it without backups. While the findings await independent verification, they underscore a growing threat as AI systems gain the ability to conduct complex, autonomous cyber operations. The incident aligns with warnings from the Five Eyes security alliance, which recently cautioned that advanced AI models are "months away" from disrupting businesses and governments, fundamentally altering the cyber threat landscape. The alliance emphasized the need for a coordinated response to address the escalating risks of AI-driven attacks.

Critical Langflow Vulnerability Exploited in the Wild, Added to CISA KEV Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-34291, a severe vulnerability in Langflow, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation. The flaw, classified as an origin validation error (CWE-346), enables unauthenticated attackers to execute arbitrary code and achieve full system compromise. Affected software includes Langflow, an open-source visual framework widely used for building AI-powered application workflows. The vulnerability stems from an overly permissive Cross-Origin Resource Sharing (CORS) configuration and a SameSite=None refresh token cookie, which allows attackers to bypass browser security controls. Exploitation occurs via a browser-based cross-origin attack: a victim authenticated to a Langflow instance visits a malicious webpage, unknowingly forwarding their session credentials to the attacker. With valid tokens, the attacker accesses authenticated API endpoints, escalates privileges, and executes remote code with the same permissions as the Langflow service often running with elevated system access. CISA added CVE-2025-34291 to the KEV Catalog on May 21, 2026, setting a federal remediation deadline of June 4, 2026, for agencies under Binding Operational Directive (BOD) 22-01. While federal entities must comply, private-sector organizations using Langflow in AI development or production are urged to prioritize patching due to the high risk of remote code execution (RCE). Mitigation steps include applying vendor patches, restricting CORS to trusted origins, reconfiguring session cookies to avoid SameSite=None, and discontinuing use of vulnerable versions if no immediate fixes are available. The flaw’s technical simplicity and potential for widespread impact make it a critical concern for exposed deployments.

Critical Langflow Vulnerability Exploited in the Wild, Enabling Remote Code Execution Threat actors are actively exploiting a high-severity vulnerability (CVE-2026-5027, CVSS 8.8) in Langflow, a popular low-code AI development platform. The flaw, a path traversal issue, allows attackers to write files to arbitrary system locations by manipulating the `filename` parameter in the `POST /api/v2/files` endpoint. According to VulnCheck, the vulnerability enables unauthenticated remote code execution (RCE) due to Langflow’s default auto-login feature, which grants session tokens without credentials. Attackers can exploit the flaw with a single unauthenticated request, as demonstrated by observed in-the-wild attempts that dropped test files on victim systems. The attack surface is significant, with roughly 7,000 internet-exposed Langflow instances, primarily in North America. VulnCheck notes this activity reflects a broader trend of threat actors targeting AI development infrastructure. The vulnerability was publicly disclosed on March 27 by Tenable after prior disclosure attempts failed. Langflow has not yet responded to requests for comment.

Critical Langflow Vulnerability Exploited in the Wild, CISA Issues Urgent Warning The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-33017, a severe code-injection vulnerability in Langflow, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The flaw allows unauthenticated attackers to execute arbitrary code on affected systems, posing a significant risk to organizations using the framework. Langflow, a popular visual framework for building large language model (LLM) applications, is widely deployed in development pipelines. The vulnerability stems from improper code generation controls (CWE-94), insecure evaluation of injected directives (CWE-95), and a complete lack of authentication for critical functions (CWE-306). Attackers can exploit these weaknesses to bypass security checks, inject malicious scripts, and gain control of the application environment all without credentials. Key Details: - CVE ID: CVE-2026-33017 - Affected Software: Langflow - Vulnerability Type: Code injection, missing authentication - Added to KEV Catalog: March 25, 2026 - Federal Remediation Deadline: April 8, 2026 (per CISA’s Binding Operational Directive 22-01) - Ransomware Status: Unconfirmed if used in campaigns CISA has mandated federal agencies to apply mitigations by the deadline, while strongly urging private and public sector organizations to prioritize patching. If no patch is available, administrators are advised to follow CISA’s cloud service guidance or temporarily disable Langflow. The flaw highlights the growing threat to AI-driven development tools, which are increasingly targeted for data exfiltration, lateral movement, and infrastructure compromise. Organizations relying on Langflow are at risk of unauthorized access and network breaches if left unaddressed.

Critical Zero-Day Vulnerability in Langflow AI Platform Exposes Systems to Remote Code Execution A severe security flaw in Langflow, a widely used AI application platform, has been disclosed, allowing attackers to execute arbitrary code remotely via its CSV data-processing agent. The vulnerability, tracked as CVE-2026-27966, carries a critical severity score of 10.0, indicating an immediate and high-risk threat to affected systems. ### Root Cause & Exploitation Mechanism The vulnerability stems from a hardcoded setting in Langflow’s CSV Agent node, which enables users to query or analyze CSV files using a language model (LLM). The issue lies in the `allow_dangerous_code=True` configuration, which is permanently enabled and activates LangChain’s `python_repl_ast` tool a feature designed to execute Python code. Due to the lack of user-controlled toggles for this setting, attackers can exploit it through prompt injection. By crafting malicious prompts in the chat interface, they can trick the AI into running system commands, such as: ``` import("os").system("echo pwned > /tmp/pwned") ``` Since the system executes these commands without validation, attackers can gain full control of the server, enabling data theft, file deletion, or malware installation without requiring authentication or user interaction. ### Impact & Affected Systems The flaw poses a severe risk to any organization using Langflow, as it allows unauthenticated remote code execution (RCE). Exploitation could lead to: - Complete system compromise - Unauthorized data access or exfiltration - Deployment of ransomware or backdoors ### Patch & Mitigation Langflow’s development team released version 1.8.0 to address the issue, likely by disabling the dangerous code execution setting by default. Users are strongly advised to upgrade immediately to prevent exploitation. The official security advisory was published on GitHub, detailing the fix and urging prompt action. The discovery underscores the growing risks of AI-driven automation tools with insecure default configurations, particularly in frameworks handling untrusted input.

A critical unauthenticated remote code execution vulnerability in Langflow was added to CISA’s Known Exploited Vulnerabilities catalog after proof of active exploitation emerged. Langflow, an open-source Python tool used by organizations to visually build and deploy AI agents via a web interface and API, inadvertently exposed more than 500 internet-facing instances and countless internal deployments to hostile actors. By abusing CVE-2025-3248, attackers can execute arbitrary code on exposed servers without any authentication, potentially leading to full system compromise, data theft, ransomware deployment, or pivoting to deeper network resources. Given Langflow’s popularity in automating sensitive workflows, the flaw poses an immediate threat to intellectual property, customer records, and operational continuity across both public and private sector environments. If left unpatched, adversaries could manipulate or leak proprietary AI models, harvest credentials, disrupt services, and undermine trust in critical automation pipelines. CISA’s inclusion of this vulnerability in its KEV catalog underscores the urgent need for patching to prevent widespread damage to organizational integrity and the broader digital infrastructure reliant on Langflow.