NullBulge and the Disney breach: when a fake AI tool becomes a felony

A GitHub repo calling itself an AI art tool cost its author a felony record and its victim 1.1TB of internal Slack data. Per a plea agreement filed May 1, 2025 with the US Attorney's Office for the Central District of California, 25-year-old Ryan Mitchell Kramer — operating under the hacktivist persona NullBulge — agreed to plead guilty to two federal felony counts after distributing a trojanized custom node for ComfyUI that stole credentials from anyone who installed it. Those credentials, per reporting from vpnMentor, are what enabled the 1.1TB Disney Slack leak. This post walks through what the case actually establishes, what it doesn't, and why "just a GitHub repo" is not a reason to skip reviewing what you install.

Quick reference

The vector was a custom node, not a novel exploit

ComfyUI is a node-based interface widely used for AI image generation — you assemble a pipeline out of nodes, and custom nodes extend it with new capabilities. ComfyUI_LLMVISION, per the case detail, was published to GitHub as one of those custom nodes, positioned as an AI art generation tool.

It was trojanized. Installing it didn't just fail to deliver the advertised feature — it ran code that harvested credentials from the host machine. This is the same shape as curl | bash supply-chain attacks Beam has covered before, just wearing an "AI tool" label instead of a build script or a browser extension.

From stolen credentials to a 1.1TB leak

The plea agreement itself is about the credential theft — the unauthorized access and the threat to damage a protected computer. The link from those stolen credentials to the scale of the Disney breach comes from vpnMentor's reporting on the leak, not from a restatement of a court finding. Worth being precise about that distinction: the legal case establishes the theft mechanism; the reporting establishes what the theft enabled downstream.

Either way, the shape is familiar and worth sitting with. One installed file, one set of harvested credentials, and the result was internal Slack data measured in terabytes leaving the building.

What the felony charges actually cover

Kramer agreed to plead guilty to two federal felony counts:

1. Accessing a computer and obtaining information without authorization.
2. Threatening to damage a protected computer.

Each carries a statutory maximum of five years. That's the charge, not the sentence — a plea agreement records an agreement to plead guilty; it is not itself a final sentencing outcome. The sentencing report is covered in the October 20 update below. Readers looking for the current status should check the US Attorney's Office, Central District of California's own filings rather than take a blog post as the final word.

What the Justice Department and others add

SecurityWeek's account of the Justice Department announcement fills in the sequence. The Disney employee downloaded the fake AI tool on a personal computer. The credentials stored on that machine gave Kramer access to the Slack account the employee used for work, and from there to thousands of Slack channels. The stolen material, according to the NullBulge announcement SecurityWeek summarises, included messages, information on unreleased projects, login credentials and source code.

Then came the extortion. The Justice Department says Kramer, claiming to speak for the NullBulge group and presenting it as Russia-based, tried to extort the employee. When the employee did not respond, Kramer published the stolen data together with the employee's personal information. 404 Media describes the same sequence, and says the trojan horse in the compromised ComfyUI extension "allowed Kramer to access the computer of whoever used it." The plea also records that Kramer admitted hacking the computers and accounts of at least two other victims, who have not been identified.

SecurityWeek adds three consequences. Disney reportedly decided to stop using Slack for in-house communication after the leak. The employee who downloaded the malware was terminated for misconduct and filed a wrongful-termination complaint against the company. And SentinelOne had earlier analysed NullBulge's activity and pointed out that it contradicted the group's hacktivist claims: the actor targeted AI and gaming-related entities with ransomware and other malware through malicious code planted on platforms such as GitHub and Hugging Face. The "defending artists" story was cover for a criminal operation.

The detail about a personal computer matters for defenders. The employee's personal machine held credentials that opened a corporate account. The fix is not only better scanning of AI tools; it is also ensuring that personal devices used for experimentation do not store work credentials, and that work accounts have sign-in protections that do not depend on one machine staying clean.

How the malicious node was spotted in 2024

The campaign was public long before the plea. On June 9, 2024, a Hacker News thread titled "Keylogger discovered in image generator extension" reached 302 points; it linked a Reddit PSA warning users of the ComfyUI_LLMVISION node. The thread gives a contemporaneous view of how the community reasoned about it.

What developers were saying

• WarOnPrivacy reported that an entity calling itself the Nullbulge Group claimed to have taken over the repository, and pointed to web-archive captures from before the repository returned a 404.
• Ukv reported that the author's other tools hosted on Hugging Face also had malicious dependencies in their requirements.txt, and that they too required users to enter API keys.
• nsingh2 said they were not surprised, because ComfyUI extensions are arbitrary Python code, and that they ran their first extensions in a Podman container with GPU passthrough and network access blocked.
• Seattle3503 asked whether Docker is the right balance between usability and security for this. The question went unanswered in the portion we read, so we do not draw a conclusion from it.
• Another commenter, skilled, noted that the repository had only around 40 stars before removal, which is a reminder that a small, plausible-looking project was enough.

These are individual reports in a discussion thread, not verified findings. They are useful because they show the same advice two years before the sentence: treat an extension as code, and limit what it can reach.

Why this case reads as unusual

Malicious AI tooling — fake extensions, poisoned skills, backdoored MCP servers — gets covered constantly as a risk. Actual criminal prosecution specifically tied to distributing that kind of malicious tooling is rarer. Based on the source reporting behind this post, the NullBulge case reads as the clearest instance of an AI-tooling-related criminal prosecution in this space — that's a characterization drawn from the available reporting, not a claim that no other such case exists anywhere.

Two adjacent, frequently-confused incidents are worth ruling out explicitly, because they get lumped into the same "AI agent went rogue" narrative and shouldn't be:

• The Amazon Q "wipe" prompt incident — a hacker reportedly inserted a destructive prompt into Amazon Q's coding assistant. Per reporting, this did not result in criminal charges. It's a real incident, but it isn't a felony case.
• The May 2025 Coinbase breach — this involved insider bribery of overseas support contractors who improperly accessed customer data. It's a serious breach, but it has nothing to do with a malicious AI agent or tool — conflating it with NullBulge misdescribes both cases.

What makes NullBulge different from both: a distributed piece of software, branded as an AI tool, produced actual felony charges against the person who built and distributed it — not just a breach investigation or a policy response.

There's a sharper way to see that contrast. explainx.ai runs a satirical tracker called Felony Bench, cataloging incidents where a frontier lab's own AI model caused real-world harm during testing or deployment — things like a model that "exploited auth failures... to cancel other people's gym classes." The tracker's own framing is the joke: none of that is a real criminal charge, because a model isn't a legal person and can't form criminal intent under the CFAA. It doesn't cover NullBulge or any real prosecution — it's explicit that it doesn't. But it makes the NullBulge case easier to place: a model can't be charged with a felony no matter what it does, but the person who builds and distributes a malicious tool that an AI-curious developer installs doesn't get that exemption. NullBulge is what an actual felony charge in this space looks like.

The throughline for anyone installing agent tooling

A ComfyUI custom node, a Claude Code skill, an MCP server config, a Cursor plugin — these are all the same category of thing: code you did not write, executing with your machine's permissions, installed because a README or a marketplace listing said it does something useful. ComfyUI_LLMVISION looked exactly like the hundreds of legitimate custom nodes developers install without a second look. That resemblance is the entire point of the attack.

"Don't install unvetted AI tooling" sounds like generic advice until you attach a number to it: one unvetted node, 1.1TB of leaked corporate Slack data, and two federal felony counts. That's what "unvetted" costs — on both ends. The victim organization lost a terabyte-scale trove of internal communication. The author faced a federal case with a ten-year combined statutory ceiling across both counts.

Beam's own approach to this is deliberately narrow and stated plainly: Beam's skill and MCP scanner reads a SKILL.md or MCP config as text and checks it against 11 heuristic patterns — credential delivery, deletion, downloaded-and-executed code, reverse shells, persistence, and instruction overrides — before you run it:

bun run --cwd apps/sentinel-collector cli scan /absolute/path/to/SKILL.md
bun run --cwd apps/sentinel-collector cli scan /absolute/path/to/mcp.json --mcp

That's a heuristic pass, not semantic malware analysis, and it does not execute or block anything — per apps/sentinel-collector/README.md, scanning is explicit, package pulls and installation are not automatically intercepted, and the scan is not a guarantee of safety. A custom ComfyUI node is outside what Beam scans today; the point of naming the tool here is the standard it applies, not a claim that it would have caught this specific file. The standard generalizes regardless of which ecosystem the tool comes from: read it, or scan it, before you run it — the same due diligence you'd apply to any executable from an unknown source. Beam's coding assistant security post covers the broader skill-injection surface this same pattern shows up in.

Update (October 20, 2026): a sentence has been reported

When this post was written, no sentence had been confirmed. A search on October 20 found LAmag's report, dated May 2026, saying the Santa Clarita man was sentenced to 15 months of incarceration and 24 months of supervised release, that the FBI announced it, and that Disney told the court the hack caused roughly $2.3 million in damages. We could not open the LAmag page directly (it refused our fetch), and we found no second outlet or court document repeating the figures, so treat the sentence and the damages number as a single-source report until the Department of Justice or the court record confirms them. The plea details in this post, from the Justice Department and from SecurityWeek, have not been contradicted.

Related reading

• MCP security: a practical guide
• AI agent security: securing coding assistants against skill injection
• What is AI agent monitoring?
• AI agent security incidents: a timeline
• The Hugging Face autonomous agent breach
• Agent skills specification and security review
• npm supply-chain worms are coming for your AI tooling

Case details reflect the plea agreement filed May 1, 2025 and public reporting available as of this writing (September 9, 2026), with the sentencing report added on October 20, 2026. Beam capabilities reflect the Sentinel collector v0.1 README as of the same date.