A GitHub repo calling itself an AI art tool cost its author a felony record and its victim 1.1TB of internal Slack data. Per a plea agreement filed May 1, 2025 with the US Attorney's Office for the Central District of California, 25-year-old Ryan Mitchell Kramer — operating under the hacktivist persona NullBulge — agreed to plead guilty to two federal felony counts after distributing a trojanized custom node for ComfyUI that stole credentials from anyone who installed it. Those credentials, per reporting from vpnMentor, are what enabled the 1.1TB Disney Slack leak. This post walks through what the case actually establishes, what it doesn't, and why "just a GitHub repo" is not a reason to skip reviewing what you install.
Quick reference
| Question | Answer |
|---|---|
| Who is charged? | Ryan Mitchell Kramer, 25, Santa Clarita, CA — persona "NullBulge" |
| What was the vector? | A malicious custom ComfyUI node, ComfyUI_LLMVISION, distributed on GitHub as a fake AI art generation tool |
| What did it do? | Stole credentials from the machine it was installed on |
| What charges? | Two felony counts — unauthorized computer access/obtaining information, and threatening to damage a protected computer |
| Maximum penalty per count | Five years, per the statutory maximum for each count |
| Has sentencing happened? | Not confirmed as of this writing — a plea agreement is an agreement to plead guilty, not a sentencing outcome |
| What did the stolen credentials enable? | Per vpnMentor's reporting, the 1.1TB Disney Slack leak |
| Was anyone else criminally charged for AI-tool-related incidents? | Not that this case can confirm — see the comparison section below |
The vector was a custom node, not a novel exploit
ComfyUI is a node-based interface widely used for AI image generation — you assemble a pipeline out of nodes, and custom nodes extend it with new capabilities. ComfyUI_LLMVISION, per the case detail, was published to GitHub as one of those custom nodes, positioned as an AI art generation tool.
It was trojanized. Installing it didn't just fail to deliver the advertised feature — it ran code that harvested credentials from the host machine. This is the same shape as curl | bash supply-chain attacks Beam has covered before, just wearing an "AI tool" label instead of a build script or a browser extension.
From stolen credentials to a 1.1TB leak
The plea agreement itself is about the credential theft — the unauthorized access and the threat to damage a protected computer. The link from those stolen credentials to the scale of the Disney breach comes from vpnMentor's reporting on the leak, not from a restatement of a court finding. Worth being precise about that distinction: the legal case establishes the theft mechanism; the reporting establishes what the theft enabled downstream.
Either way, the shape is familiar and worth sitting with. One installed file, one set of harvested credentials, and the result was internal Slack data measured in terabytes leaving the building.
What the felony charges actually cover
Kramer agreed to plead guilty to two federal felony counts:
- Accessing a computer and obtaining information without authorization.
- Threatening to damage a protected computer.
Each carries a statutory maximum of five years. That's the charge, not the sentence — a plea agreement records an agreement to plead guilty; it is not itself a final sentencing outcome, and this post is not claiming to know what sentence, if any, has since been handed down. Readers looking for the current status should check the US Attorney's Office, Central District of California's own filings rather than take a September 2026 blog post as the final word on where the case stands today.
Why this case reads as unusual
Malicious AI tooling — fake extensions, poisoned skills, backdoored MCP servers — gets covered constantly as a risk. Actual criminal prosecution specifically tied to distributing that kind of malicious tooling is rarer. Based on the source reporting behind this post, the NullBulge case reads as the clearest instance of an AI-tooling-related criminal prosecution in this space — that's a characterization drawn from the available reporting, not a claim that no other such case exists anywhere.
Two adjacent, frequently-confused incidents are worth ruling out explicitly, because they get lumped into the same "AI agent went rogue" narrative and shouldn't be:
- The Amazon Q "wipe" prompt incident — a hacker reportedly inserted a destructive prompt into Amazon Q's coding assistant. Per reporting, this did not result in criminal charges. It's a real incident, but it isn't a felony case.
- The May 2025 Coinbase breach — this involved insider bribery of overseas support contractors who improperly accessed customer data. It's a serious breach, but it has nothing to do with a malicious AI agent or tool — conflating it with NullBulge misdescribes both cases.
What makes NullBulge different from both: a distributed piece of software, branded as an AI tool, produced actual felony charges against the person who built and distributed it — not just a breach investigation or a policy response.
There's a sharper way to see that contrast. explainx.ai runs a satirical tracker called Felony Bench, cataloging incidents where a frontier lab's own AI model caused real-world harm during testing or deployment — things like a model that "exploited auth failures... to cancel other people's gym classes." The tracker's own framing is the joke: none of that is a real criminal charge, because a model isn't a legal person and can't form criminal intent under the CFAA. It doesn't cover NullBulge or any real prosecution — it's explicit that it doesn't. But it makes the NullBulge case easier to place: a model can't be charged with a felony no matter what it does, but the person who builds and distributes a malicious tool that an AI-curious developer installs doesn't get that exemption. NullBulge is what an actual felony charge in this space looks like.
The throughline for anyone installing agent tooling
A ComfyUI custom node, a Claude Code skill, an MCP server config, a Cursor plugin — these are all the same category of thing: code you did not write, executing with your machine's permissions, installed because a README or a marketplace listing said it does something useful. ComfyUI_LLMVISION looked exactly like the hundreds of legitimate custom nodes developers install without a second look. That resemblance is the entire point of the attack.
"Don't install unvetted AI tooling" sounds like generic advice until you attach a number to it: one unvetted node, 1.1TB of leaked corporate Slack data, and two federal felony counts. That's what "unvetted" costs — on both ends. The victim organization lost a terabyte-scale trove of internal communication. The author is now the subject of a federal case with a ten-year combined statutory ceiling across both counts.
Beam's own approach to this is deliberately narrow and stated plainly: Beam's skill and MCP scanner reads a SKILL.md or MCP config as text and checks it against 11 heuristic patterns — credential delivery, deletion, downloaded-and-executed code, reverse shells, persistence, and instruction overrides — before you run it:
bun run --cwd apps/sentinel-collector cli scan /absolute/path/to/SKILL.md
bun run --cwd apps/sentinel-collector cli scan /absolute/path/to/mcp.json --mcp
That's a heuristic pass, not semantic malware analysis, and it does not execute or block anything — per apps/sentinel-collector/README.md, scanning is explicit, package pulls and installation are not automatically intercepted, and the scan is not a guarantee of safety. A custom ComfyUI node is outside what Beam scans today; the point of naming the tool here is the standard it applies, not a claim that it would have caught this specific file. The standard generalizes regardless of which ecosystem the tool comes from: read it, or scan it, before you run it — the same due diligence you'd apply to any executable from an unknown source. Beam's coding assistant security post covers the broader skill-injection surface this same pattern shows up in.
Related reading
- MCP security: a practical guide
- AI agent security: securing coding assistants against skill injection
- What is AI agent monitoring?
- AI agent security incidents: a timeline
- The Hugging Face autonomous agent breach
Case details reflect the plea agreement filed May 1, 2025 and public reporting available as of this writing (September 9, 2026); sentencing status may have changed since. Beam capabilities reflect the Sentinel collector v0.1 README as of the same date.