Synthesized by Clarity (Claude) from 15 sources · May contain errors — spot one? [email protected] · Methodology →
NadMesh Harvests Cloud Keys from Exposed Ollama, ComfyUI
- Sources
- 15
- Words
- 1,132
- Read
- 6min
◆ The signal
NadMesh scans Shodan for self-hosted AI tooling, then pivots the IAM role or K8s token on the box into the whole cloud account. Its dashboard claims 3,811 AWS keys harvested in two weeks. That figure measures dashboard reporting, not independent verification; the exposure path is real, and any long-lived credential reachable from an exposed inference endpoint is effectively already compromised.
◆ INTELLIGENCE MAP
Intelligence map
01 Self-Hosted AI Infra Is a Named Attack Target
act nowNadMesh, a Go botnet, uses Shodan to enumerate ComfyUI (8188), Ollama (11434), and n8n (5678) and scrapes cloud credentials — its dashboard claims 3,811 AWS keys since early July. Meanwhile 93% of teams have hit an AI-caused infra incident but only 30% have a governing policy. The real loss is the exposed box's IAM role, not the GPU.
- Ollama port
- Shadow AI users
- Teams w/ AI incident
- Hit an AI infra incident93%
- Have a governing policy30%
02 Efficiency Lives in the Orchestration Layer
monitorA step-1 early-abort classifier reads a model's internal signals to kill doomed agent runs, cutting compute up to 60% while retaining ~90% task success — a retrofit, not a model swap. Auto-tuned skill files lift task success 28.6% with zero retraining. And the protocol wars ended: ACP merged into A2A, so MCP and A2A now coexist by layer.
- Compute saved
- Success retained
- Skill-file lift
03 The Task-to-Outcome Conversion Gap
monitorAn NBER natural experiment (25K workers, ~7K workplaces, 11 occupations) found generative AI saved 2.8% of work time, with 64–90% reporting savings — yet admin records show ~zero change in hours or earnings, CIs ruling out effects above 2%. Same failure mode as an offline metric win that never moves an online KPI, measured at scale.
- Workers studied
- Time saved
- Earnings effect
04 Open-Weight No Longer Means Cheap
backgroundKimi K3 lists output at $15/M — half of GPT-5.6 Sol ($30), under a third of Claude Fable 5 ($50), but 24x above DeepSeek V4 Pro. Open-weight has repriced: capability now commands frontier-like pricing. Meanwhile colibri streams the 744B GLM-5.2 on a 25GB-RAM box, and SK Hynix forecasts its worst-ever memory shortage in 2027.
- Kimi K3 output
- vs DeepSeek
- GLM-5.2 RAM
◆ DEEP DIVES
Deep dives
01 Your Inference Box Is a Cloud-Account Pivot, Not a Contained GPU
act now evidence: mediumNadMesh matters because a self-hosted inference box rarely has a contained blast radius. If your Ollama node carries an IAM role or a mounted Kubernetes service-account token, one Shodan hit reads your S3 training buckets, hits the model registry, or talks to the control plane. The GPU is the least valuable thing on the machine.
The method itself is unremarkable, which is the point. A Shodan harvester restocks a scan queue, probes default ports — ComfyUI on 8188, Ollama on 11434, n8n on 5678 — and where it finds an exposed instance scrapes long-lived AWS keys and K8s tokens from environment variables, mounted files, and instance metadata. The operator dashboard claims 3,811 unique AWS keys in roughly two weeks. Treat that as a self-reported bragging ceiling, not verified telemetry. The count is unverified. The mechanism generating it is not.
The same weak link shows up in SaaS token sprawl and shadow AI too: long-lived credentials plus ungoverned egress. Orphaned keys to experiment trackers, managed vector DBs, and model registries sit in notebooks and CI secrets. Separately, about 65% of senior decision-makers report piping prompts and data through unlogged endpoints. Different surfaces, same root cause: credentials and data flows nobody is watching.
The fix is structural, not reactive. Short-lived, scoped tokens (IRSA/OIDC) expire before a harvested credential is useful, which neutralizes NadMesh's business model against a given account without requiring anyone to catch the breach first. For egress, a sanctioned inference gateway — a logged proxy with PII redaction and per-team quotas — converts invisible risk into an instrumented flow. It's the approach that survives the reality that leadership won't self-restrict. Ban-based policy has a compliance ceiling; a better default path doesn't.
One adjacent shift worth tracking: model errors are getting reclassified as security and legal incidents, not just accuracy problems. Drift detection that pages nobody is a metric nobody reads, not incident response. Wiring drift thresholds, confidence-collapse detectors, and output-safety filters to escalation owners and an automated rollback to last-known-good is what turns a failing model into a runbook instead of a dashboard.
Action items
- Run an external Shodan/nmap scan today for any exposed 8188/11434/5678 endpoints and put anything reachable behind auth or a private subnet before end of week.
- Rotate every AWS key and K8s service-account token ever reachable from an exposed AI service, and migrate to IRSA/OIDC short-lived credentials this sprint.
- Stand up a sanctioned LLM inference gateway with request logging, PII redaction, and per-team quotas this sprint to convert shadow-AI egress into an observable flow.
Sources:The Hacker News · CSO First Look · CSO Update
02 The 60% Compute Win Bolts Onto Your Agents Without Touching Weights
monitor evidence: mediumThe interesting part of the early-abort result is the access requirement, not the 60% figure. A step-1 abort classifier is conceptually cheap: a small model over first-step signals like confidence, entropy, and hidden-state features predicting terminal failure. Those features require model internals, which is trivial on open-weight models you host and impossible behind closed APIs that never expose logits. That makes this efficiency win one more line in the self-host column.
The reported payoff cuts agent compute up to 60% while retaining ~90% task success, framed as an orchestration retrofit rather than a model swap. The more portable sibling is auto-tuned skill files, which optimize an external artifact against real system diffs to lift task success 28.6% with zero retraining, a fit for data agents fighting schema and pipeline drift. Both results sit at news-roundup grade: 0.75 confidence, 'up to' framing, no ablations, no median. That makes the numbers cheap to validate but not yet safe to trust.
What makes them actionable is a companion framework: eval complexity scales with architecture. The recipe stays constant. Pick a task, collect eval data, build a grader. The grading modality shifts every time you add a component:
System What you grade Grader RAG Retrieval + faithfulness Judge on both stages Coding agent End-to-end bug fix Run unit tests on the patch Multi-agent Coordination + role adherence Code tests + LLM-judge + human review The uncomfortable implication: if you graduated to a multi-agent orchestrator but your evals still score only the final answer, you're blind to exactly the coordination failures the orchestrator introduced.
Underneath all this, the protocol question finally settled: ACP has been folded into A2A. MCP owns agent-to-tool; A2A owns agent-to-agent, with peers discovered via an Agent Card and an input-required state that loops mid-task. Production stacks run both, and any lingering ACP code path is migration debt worth killing before it compounds.
Action items
- Prototype a step-1 early-abort classifier on your highest-cost multi-step workflow using logit/hidden-state/confidence features and measure compute saved vs success retained against a holdout this sprint.
- Expand your eval harness component-by-component to match your architecture — separate retrieval and generation graders for RAG, coordination checks for multi-agent — this sprint.
- Audit for any ACP-based agent integrations and plan migration to A2A (Agent Card discovery, input-required state handling) this quarter.
Sources:Techpresso · ByteByteGo
03 AI Saved 2.8% of Work Time and Zero Dollars — Instrument the Conversion
background evidence: mediumThe study design is what makes the null worth taking seriously. Humlum & Vestergaard linked self-reported survey data to administrative earnings and hours records across roughly 25,000 workers, 7,000 workplaces, and 11 high-exposure occupations. Workers self-reported real savings — 2.8% of total work time, with 64–90% reporting some benefit — but the administrative data puts the estimate near zero, and the confidence interval rules out average effects above roughly 2%. That's a tight bound, not a shrug. The sample size is doing real work here, which is the part a smaller study couldn't have delivered.
Two explanations survive contact with this data, and they don't collapse into one another. There's a conversion gap, where the saved time got redirected into other tasks and never showed up as output. And there's a measurement gap, where the value flowed into channels — revenue, quality, avoided risk — that nobody instrumented. If you're building eval harnesses for production models, telling these two apart is not a side quest. It is the job.
The translation to eval practice is mechanical, which is the good news. For every production model, trace offline metric → workflow change → business KPI, and check that the terminal KPI actually shows up in telemetry. If it doesn't, you can't attribute value to anything, and you will reproduce the same false null the administrative records nearly produced. Pre-register a capture mechanism — throughput, cost, SLA, reallocation — before rollout. Efficiency without a designated sink diffuses. It doesn't concentrate on its own.
Two adjacent findings sharpen this. Multi-step agents compound error at a rate that single-turn accuracy hides entirely: a model at 95% per-step reliability fails roughly 40% of 10-step tasks. The benchmark that reports per-step accuracy is not measuring the bottleneck you'll hit in production — measure task-completion rate and trajectory correctness instead. Separately, the claim that engineering and research have fused is testable against this same logic: whoever owns the versioned, reproducible eval harness is the one whose hypotheses get tested against reality rather than against a leaderboard. Eval infrastructure is the throughput multiplier here, not overhead.
The honest caveat: a two-year post-ChatGPT window is plausibly underpowered against diffusion lag. Solow's paradox took roughly two decades to resolve, and nobody called that a failure of computers. Read this result as "measure the conversion," not "AI doesn't work" — the data supports the narrower claim, not the broader one.
Action items
- Map offline metric → workflow change → business KPI for each production model and confirm the terminal KPI is instrumented in telemetry, this sprint.
- Pre-register a capture mechanism and run the MDE math before your next rollout so an underpowered holdout can't report a false 'no impact.'
Sources:🔳 Turing Post · Oren Ellenbogen · The Information Weekend
◆ QUICK HITS
Quick hits
AWS billing subsystem emitted ~$2.5B in phantom cost estimates and a rollback failed to fix it
Systematic image-captioning error detection hit 63.8% of test datasets, ~4x prior tooling
A batch-diversity training tweak lifted fairness scores 0.23–0.36 with no reported quality loss
Kubernetes now has a documented path to autoscale model serving on queue depth
OpenSSL HollowByte DoS: an 11-byte request reserves 131KB until restart
Anthropic alleges Moonshot distilled Claude via 3.4M exchanges through fraudulent accounts
Production Redis for agent state should run AOF + RDB combined, not RAM-only
◆ Bottom line
The take.
Stop tuning the model and start instrumenting the layer around it — the orchestration loop, the credential boundary, and the business KPI are where this quarter's leverage and exposure actually live.
Frequently asked
- How does a single exposed Ollama box become a full cloud account compromise?
- The box usually carries an IAM role or a mounted Kubernetes service-account token, so scraping those long-lived credentials from environment variables, mounted files, or instance metadata lets an attacker reach S3 buckets, the model registry, and the control plane. The GPU is the least valuable thing on the machine — the blast radius is your whole account.
- Should I trust the claim of 3,811 AWS keys harvested?
- Treat it as a self-reported figure from the operator's dashboard, not verified telemetry — it measures dashboard reporting rather than independent confirmation. The count is unverified, but the mechanism generating it is real, so any long-lived credential reachable from an exposed inference endpoint should be considered already compromised.
- What should I do first if I'm running self-hosted AI tooling?
- Run an external Shodan or nmap scan today for exposed ports 8188 (ComfyUI), 11434 (Ollama), and 5678 (n8n), and put anything reachable behind auth or a private subnet. Then rotate every AWS key and K8s token ever reachable from those services and migrate to short-lived IRSA/OIDC credentials, which expire before a stolen credential is useful.
- Why can't I use the 60% agent compute savings behind closed APIs?
- The early-abort classifier depends on model internals — confidence, entropy, and hidden-state features from the first step — which open-weight models you host expose but closed APIs never do because they don't return logits. That makes this particular efficiency win effectively a self-hosting advantage, and one still worth validating given its 'up to' framing.
- If AI saved workers 2.8% of their time, why did earnings and hours barely move?
- Two explanations survive the data: a conversion gap, where saved time gets redirected into other tasks and never becomes measurable output, and a measurement gap, where value flows into revenue, quality, or avoided risk that nobody instrumented. Telling them apart requires tracing offline metric to workflow change to a business KPI that actually appears in telemetry.
◆ Same day, different angle
Read this day as…
◆ Recent in data science
Keep reading.
Spot an error? [email protected]