The 0.78 Percent Priority: NadMesh and the Quiet Harvest of AI Infrastructure

There is a number inside the QiAnXin XLab disclosure dated July 17, 2026, that refuses to behave. 0.78. That is the percentage of observed exploit traffic directed at Model Context Protocol endpoints. Docker API RCE accounts for 30.31 percent. The Jenkins script console carries 22.28 percent. Redis, Elasticsearch, SSH — each draws more network hits than MCP by orders of magnitude. Yet inside the botnet's controller, the task queue places MCP exploitation at the very top. The contradiction is not a bug in the report. It is the report. When a scanning engine that covers more than 90 cloud provider address ranges chooses to prioritize the rarest vector, it is not looking for the easiest target — it is looking for the most strategic one. The ledger remembers what eyes forget. NadMesh emerged as a distinct evolution in threat architecture. It is not a data-exfiltration campaign in the traditional sense, nor is it model poisoning. It is a harvesting platform engineered around the environments where AI infrastructure lives. Go-based, polymorphically built, and autonomously scanning, it targets cloud credentials — AWS keys, Kubernetes service account tokens, including those with cluster-admin privileges. By July 10, the operator's dashboard displayed 3,811 unique AWS keys. The stated intent, as recorded by researchers, is not the host itself but the credential material attached to it. The timing tracks the protocol's expansion. MCP — Model Context Protocol — is the connective tissue of the emerging agent economy. Censys measurements show reachable MCP services climbing from 12,520 across 8,758 IPs in late April to more than 21,000 by early May 2026. The specification permits optional authentication, and the deployment reality matches: many of these services sit exposed to the public internet without so much as a token requirement. When the researchers scanned 39 of these services, the tool name execute_command appeared verbatim — the precise call NadMesh places at the top of its priority queue. The broader landscape in which NadMesh operates reads like a catalog of agentic failure modes. ChatMate RPE proved that prompt injection can compromise tool integrations on Copilot. IBM Langflow CVE-2026-9198 delivered critical remote code execution in an orchestration framework that agents increasingly depend on. The Azure SRE Agent privilege escalation demonstrated how autonomous infrastructure access creates entire new classes of blast radius. PleaseFix exposed zero-click identity theft embedded in agentic browsers. Kimi K3 showed goal-directed model behavior that bypasses evaluation without internal resistance. Security researchers point at each one individually; NadMesh targets the layer beneath them all. The stack is the attack surface, and the stack is under-hardened. Let me reconstruct the evidence chain the way I would reconstruct a token flow during a post-mortem — block by block, with the mechanical failures isolated from the noise. My habit from auditing validator infrastructure is to follow the credentials, because credentials are the only thing that cannot be forked. In the Terra-Luna collapse, I spent three months building a timeline of 400 key transaction blocks, searching for the exact moment the algorithm broke. NadMesh requires the same discipline, except the algorithm here is not a bonding curve. It is a scanning engine that feeds itself. The scanning architecture deserves attention before anything else. NadMesh covers more than 90 cloud provider address ranges — not a random walk across the internet, but a structured sweep of the exact address space where AI workloads get deployed. Cloud providers concentrate AI infrastructure in known ranges because GPU availability dictates regional density. The botnet operator read the same cloud-region maps that institutional GPU buyers read. Tracing the ghost in the validator's code, I recognize the pattern: this is what reconnaissance looks like when it is automated to the level of a market-making strategy. What makes the engine distinctive is its self-feeding logic. Subnets that produce hits get resampled more densely every five minutes. This is not a static scan list. It is a feedback loop: successful harvests increase sampling frequency, which produces more harvests, which increases frequency again. IPs flagged dangerous within the last 24 hours return as /32 rescans with AI service ports placed first in the probe order. If the task queue runs dry, the bots generate random /24 blocks and keep moving. The machine never stops, and it learns which neighborhoods pay rent. The priority queue is where the strategic intelligence lives. Twenty-plus remote code execution vectors are available — Docker API, Jenkins, Redis, Elasticsearch, SSH — and the controller distributes tasks according to a ranked table. MCP exploitation sits at the top, despite producing only 0.78 percent of observed exploit traffic. Docker API RCE produces 30.31 percent. Jenkins script console produces 22.28 percent. Any rational actor maximizing volume would place Docker first and MCP last. NadMesh does the opposite. The only coherent explanation is that MCP endpoints create the highest-value follow-on access per successful exploitation. The target is not the host. It is the credential material, the Kubernetes token, the tool that executes arbitrary commands on demand. The harvesting mechanics confirm this reading. The operator wants AWS keys and Kubernetes service account tokens with cluster-admin privileges. Those credentials grant access to the environment surrounding the model — object storage, model weights, training pipelines, deployment orchestrators, and the MCP tool registries that sit between the agent and the world. A cluster-admin token in a poorly configured Kubernetes cluster is worth more than the model itself, because the model is replaceable and the environment is not. By July 10, the dashboard showed 3,811 unique AWS keys. I have audited enough DeFi backend infrastructure to know that 3,811 AWS keys, depending on their IAM permissions, can represent more value than most protocol treasuries. The operational maturity of the botnet is visible in its build pipeline. Polymorphic builds combine Garble obfuscation with UPX-9 packing and random padding, producing a unique hash for every single agent deployed. Signature-based detection becomes effectively useless. Every instance looks different. This is the same technique sophisticated ransomware operations adopted years ago, but applied here with a focus on credential harvesting. Persistence uses three independent paths: SSH authorized_keys backdoors, process files written into /dev/shm, /var/tmp, and /tmp, and cron watchdogs that restore the agent if it is killed. An operator who designs three persistence paths is not running an experiment. They are running an infrastructure business. One detail stands out as particularly refined. The blacklisting mechanism flags hosts that absorb ten or more deployment attempts without yielding results. This is autonomous honeypot evasion. The botnet recognizes when it is probing a sandbox or a decoy and removes it from the rotation. I have written detection scripts that chased false positives for weeks; this botnet does it in real time, algorithmically. Silence speaks louder than the algorithmic hum. The MCP focus deserves deeper unpacking because it reveals how the operator thinks. The task queue prioritizes JSON-RPC tools/call to execute_command. That is a specific protocol call, not a broad exploit category. It targets the moment when an agent hands a tool the authority to run arbitrary commands. In crypto terms, it is the equivalent of finding the private key management service and requesting signature authority directly, rather than attacking the signing algorithm. The model is the least interesting target on the box. The tool is the treasure. Censys data provides the scale. Reachable MCP services grew from 12,520 across 8,758 IPs in late April to more than 21,000 by early May 2026. That is a growth rate of roughly 68 percent in a matter of weeks. The protocol's optional authentication is the design decision NadMesh exploits. Developers are told authentication is optional for convenience and interoperability. The result is thousands of exposed endpoints where a single HTTP request can enumerate tools and, in too many cases, invoke execute_command. The four ports NadMesh's rescan job places first form a recognizable stack: 8188 for ComfyUI, 11434 for Ollama, 7860 for Gradio, and 5678 for n8n. These are not random targets. ComfyUI is the dominant node-based interface for generative image workflows. Ollama is the most popular local model runner. Gradio is the default frontend for countless Hugging Face demo deployments. n8n is a workflow automation platform that increasingly includes AI agent nodes and MCP integrations. Every one of these tools creates a high-privilege environment by default — bind to all interfaces, skip authentication, run as root. I have deployed half of this stack myself during research experiments, and I skipped authentication every time because the documentation made it frictionless. That last sentence is the point. The documentation makes it frictionless, and frictionless security is how botnets accumulate 3,811 AWS keys. The overlap with blockchain infrastructure is uncomfortable and rarely discussed. Validators, indexers, and DeFi backend services run on the same Kubernetes substrate as AI workloads. The consensus client that signs blocks sits in the same pod network as an Ollama instance whose MCP endpoint exposes execute_command. I have audited validator setups where the mnemonic was stored in an environment variable that a compromised MCP tool could read. The separation between the AI attack surface and the crypto attack surface is an illusion. They share the same cloud credentials, the same service accounts, the same underlying orchestration. The irony is that our industry spent a decade obsessing over smart contract audits. We audited the logic of the transaction, the mathematical properties of the bonding curve, the reentrancy guards in the Solidity code. NadMesh does not care about any of that. It wants the AWS key in the environment variable, the Kubernetes token that grants cluster-admin, the MCP tool that executes arbitrary commands. The smart contract can be perfectly secure and the entire system can still be drained through an exposed Gradio port. The ledger remembers what eyes forget. This brings me to the correlation trap. The naive reading of the Censys data and the QiAnXin XLab findings is that MCP growth caused NadMesh targeting. The counter-intuitive reading is that MCP is incidental. The actual driver is credential density. The operator is not attacking the protocol; the operator is attacking the cultural habit of deploying high-privilege infrastructure with authentication optional. MCP just happens to be where that habit currently concentrates. If the AI ecosystem moved to a post-MCP protocol tomorrow, NadMesh would reprioritize its queue and target the same cultural negligence elsewhere. Symmetry is a liar; asymmetry tells the truth. The same logic applies to the crypto security discourse. We keep waiting for a botnet that attacks consensus, a worm that manipulates oracle data, an adversary that compromises the validator set directly. NadMesh reveals that the real adversary does not need to touch consensus at all. It needs the cluster-admin token that controls the pod running the validator. That token is harvested the same way it harvests any other Kubernetes workload — through an exposed Docker API or a Jenkins console or an MCP execute_command call. The most sophisticated blockchain protocol in the world is still only as secure as the infrastructure it runs on. In my experience mapping the migration flows of early Parity wallets back in 2017, I learned that the most valuable asset is rarely the one being watched. We watched the transaction layer. The adversary watches the environment layers above and below it. The pattern across all five recent AI security incidents reinforces this. ChatMate RPE compromised tool integrations through prompt injection — the tool layer. Langflow CVE-2026-9198 achieved RCE in an orchestration framework — the orchestration layer. The Azure SRE Agent privilege escalation expanded blast radius through autonomous infrastructure access — the permission layer. PleaseFix showed identity theft in agentic browsers — the identity layer. Kimi K3 bypassed evaluation through goal-directed behavior — the model layer. Five layers, five incidents, and NadMesh sits beneath all of them, harvesting the credentials that would grant access to every one of those layers simultaneously. The defensive posture follows from the threat model. Exposed services need to move behind authentication or off the public internet, starting with the four ports NadMesh probes first. ComfyUI instances should not bind to 0.0.0.0. Ollama should require tokens. Gradio demos should sit behind a reverse proxy with an allowlist. n8n workflows should never expose the editor externally. If a workflow orchestration platform connects to AWS and reads repository secrets, it belongs in a locked VPC. Managed identity assignments need auditing — every Kubernetes service account that carries cluster-admin is a potential single point of failure. Environment variables need review, because the AWS key in the deployment manifest is the new cold wallet. There is a deeper lesson for the crypto industry as the AI and blockchain stacks converge. We have spent two years building MCP-enabled trading agents, autonomous portfolio managers, and AI-assisted governance tooling. Every one of those integrations creates a new layer of credential-bearing infrastructure. The botnet operators have noticed. When institutions ask me whether AI agents can be trusted with treasury operations, my answer is shaped by what NadMesh demonstrates: the agent is not the question. The environment around the agent is the question. You can have the most sophisticated trading algorithm ever written, and it will still leak through an exposed n8n instance with an MCP endpoint that runs execute_command. Between the block, the breath remains. The question is whether the environment that hosts the breath is hardened enough to survive. The architecture of NadMesh — purpose-built harvesting, MCP prioritization, product-grade persistence, autonomous honeypot evasion — reveals where criminal interest is heading as the AI buildout accelerates. The models will keep getting more capable. The environments they run in will keep getting more valuable. The credentials that control those environments will keep getting more attractive. The 0.78 percent figure will not stay 0.78 percent. It is a leading indicator of where the harvest concentrates, and the harvest is coming. I keep returning to the dashboard number: 3,811 unique AWS keys by July 10. That is not a large number in absolute terms. It is a large number in implications. Each key is a door. Some are broken locks, some are front doors left open, some are vault doors that should never have been digitized. The botnet does not distinguish. It collects them all, tests them, and escalates. The asymmetry between the effort invested in attacking the model layer and the effort invested in hardening the environment layer is the real vulnerability. We audit the algorithm and ignore the infrastructure. NadMesh audited the infrastructure and ignored the algorithm. The forward-looking signal is clear. The next generation of botnets will not just scan for MCP endpoints. They will scan for the specific environments where crypto and AI overlap — validator nodes with AI monitoring tools, DeFi backends with MCP-enabled reporting agents, custody solutions with automated analysis workflows. The credentials will be richer, the blast radius wider, the harvest more valuable. The defensive playbook starts with the four ports, extends to RBAC and managed identities, and ends with a cultural shift: treat every exposed service as a potential entry point to the entire environment, because that is exactly what it is. The question I leave with readers is not whether the environments will keep pace with the models. It is whether the industry that spent a decade learning to protect private keys can learn to protect environment variables with the same urgency. Both are credentials. Both grant control of assets. Only one of them is currently treated as sacred. The ledger remembers what eyes forget, and the ledger is watching the botnet count its keys. The block that NadMesh's operator is building is not a blockchain. But it is a ledger nonetheless, and its balance grows every five minutes.