The industrial sector’s adoption of AI tools for process optimisation, predictive maintenance, and operational analytics has accelerated significantly in 2024 and 2025. The tools enabling this adoption include n8n for workflow automation, Langflow for AI pipeline orchestration, Node-RED for IoT/OT data integration, and increasingly, purpose-built industrial AI platforms that wrap these same components. These tools are being deployed on OT DMZ segments, data historian servers, and SCADA adjacent systems, often by operations teams rather than IT or security teams, and often without the security configuration these tools require.
The NadMesh botnet, documented in July 2026, has n8n and Langflow as explicit targets in its exploit module library. This creates a threat path that security teams focused on IT and cloud environments may not have assessed: a scan of industrial IP ranges for exposed AI workflow interfaces, exploitation of an unauthenticated endpoint, and a pivot toward historian databases and SCADA-connected systems that sit on the same network segment.
What These Tools Are Doing in Industrial Environments
Understanding the deployment patterns helps understand the risk.
n8n is a general-purpose workflow automation platform with over 400 integrations. In industrial contexts, it is used to connect OT data (from historians like OSIsoft PI, Ignition, or AspenTech) with AI analysis services, generate automated maintenance reports from SCADA data, and orchestrate multi-step processes that combine OT sensor data with business system inputs. A typical deployment connects n8n to the OT historian via an OPC-UA or REST API integration, and to external services (cloud AI APIs, ticketing systems, ERP) via the IT network. This puts n8n in a bridging position between OT and IT.
Langflow provides a visual builder for LLM-based applications. Industrial use cases include natural language querying of process data (“what was the average temperature on Reactor 3 yesterday”), automated anomaly explanation systems that correlate sensor data with maintenance records, and training data preparation pipelines for industrial AI models. Langflow instances in industrial environments are often connected to both the historian database and to cloud-hosted LLM APIs.
Node-RED is longer established in the IIoT space and widely used for OT data flow orchestration. It is typically more carefully deployed than newer AI tools because the OT community has more experience with it. But it has its own vulnerability history and, when deployed with default settings, presents the same unauthenticated interface problem.
NadMesh’s OT Relevance
NadMesh’s exploit modules for n8n (default port 5678) and Langflow (default port 7860) target the unauthenticated API endpoints that allow workflow execution and code evaluation. For n8n, the Execute Command node and Function nodes allow arbitrary JavaScript and system command execution in the context of the n8n process. For Langflow, CVE-2025-3248 provides unauthenticated remote code execution via the code validation endpoint.
When these tools are deployed on an OT DMZ host that also has connectivity to the OT historian:
- NadMesh scans for exposed n8n/Langflow endpoints on industrial IP ranges via Shodan API queries
- Exploitation provides code execution on the AI workflow host
- The workflow host’s network connectivity to the historian is inherited by the attacker
- From the historian, depending on segmentation, the attacker may reach SCADA servers, HMI systems, or in poorly segmented environments, engineering workstations with direct PLC connectivity
This is a lateral movement path from an internet-facing AI service to OT infrastructure, enabled by the bridge position these tools occupy in industrial architectures.
Risk Assessment by Deployment Pattern
Highest risk: AI workflow tool with public internet exposure and OT historian connectivity
This is the NadMesh target. An n8n or Langflow instance accessible from the public internet, deployed on a host with database connections to an OT historian, represents an exploitable path to OT data and potentially to OT control functions if historian connectivity extends further.
High risk: AI workflow tool on OT DMZ with authenticated external access
Even with authentication enabled, if the AI workflow tool is accessible from the enterprise IT network and has historian connectivity, a compromised IT environment creates an OT pivot path. This is a Purdue model zone violation: Level 3 tools communicating bidirectionally with Level 2 or Level 1 systems without appropriate data diodes or one-way gateway controls.
Moderate risk: AI workflow tool on isolated network with no historian-to-SCADA connectivity
If the AI workflow tool receives historian data only (no write path to OT systems) and the network segment hosting it has no route to SCADA or engineering workstation networks, the blast radius of a compromise is limited to data exfiltration rather than process disruption.
Immediate Actions
Audit your AI workflow deployments in industrial environments. Identify every n8n, Langflow, Node-RED, or similar tool deployed in OT DMZ segments, on historian servers, or in any network zone that has connectivity to OT systems. This audit frequently reveals deployments made by engineering or operations teams without IT/security involvement.
Remove internet exposure immediately. AI workflow tools in industrial environments should never be directly internet-accessible. If remote access is required, it must route through VPN with MFA, with the VPN gateway isolated from the AI tool’s OT network connectivity.
Apply available patches. Langflow CVE-2025-3248 is patched in version 1.9.0. n8n has authentication controls that must be explicitly enabled. Review current versions and enable authentication for all tools.
Implement network segmentation between AI workflow hosts and OT systems. AI workflow tools that consume OT historian data should receive that data through a one-way data diode or through a historian API that provides read-only access with no command execution capability. The AI workflow host should not have routable connectivity to SCADA servers, HMI systems, or engineering workstations.
Monitor for unexpected outbound connections from historian and OT DMZ hosts. NadMesh’s post-exploitation activity includes outbound connections to command and control infrastructure. Historian servers and OT DMZ hosts should have defined, audited outbound connection profiles. Any connection to an external IP not in that profile warrants immediate investigation.
The Underlying Pattern
The AI tooling adoption in industrial environments mirrors a pattern that has repeated throughout the history of OT/IT convergence: a useful tool gets deployed for operational efficiency, the security implications of its network position are not fully assessed at deployment time, and a threat actor finds and exploits the exposure before a security review catches it.
The Purdue model and IEC 62443 zone/conduit frameworks exist precisely to manage this: new capabilities that span zone boundaries need security review of the data flows, the execution permissions of the new tool, and the network paths it creates. Applying that review to AI workflow tool deployments in industrial environments is an immediate priority.