[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Detecting Generative AI Data Leaks from ComfyUI](/blog/detecting-generative-ai-data-leaks-from-comfyui) Publish date June 22, 2025 {x} minute read # Detecting Generative AI Data Leaks from ComfyUI [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/artificial-intelligence-and-the-future-of-tprm) [Free trial](/demo) Written by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Reviewed by Table of contents eBook Artificial Intelligence and the Future of TPRM Free resource ### Artificial Intelligence and the Future of TPRM [Download now](/resources/artificial-intelligence-and-the-future-of-tprm) By now we’re all familiar with the capabilities of generative AI for creating images. For some tasks, like casting an existing image in a recognizable art style, it works well. Much more than that and it encounters limitations: complex prompts often don’t return exactly what you imagined and iterating on a failed prompt can quickly become time-consuming.  In an attempt to make image generation more reliable at scale, ComfyUI provides a visual, node-based workflow builder that ensures certain properties are present or absent in the resulting image. ComfyUI instances configured for anonymous access allow anyone on the internet to see those workflows and the images they generate. In our research, we found at least 60 ComfyUI servers exposed to the internet and leaking data. You can probably guess one thing they were being used to generate… but there are also some surprises.  ## What is ComfyUI? ComfyUI is a relatively new technology, first released at the beginning of 2023. Riding the wave of interest in generative AI, community adoption continued through 2024, earning [77k stars on Github](https://github.com/comfyanonymous/ComfyUI) and garnering support from mainstream corporate software like [Nvidia RTX Remix](https://github.com/NVIDIAGameWorks/ComfyUI-RTX-Remix). ComfyUI provides a visual, node-based editor for defining operations in a workflow. Thus the interface includes lists of models, nodes, and workflows the user has created. In an exemplar workflow pictured below, a user might select different models to perform different steps in generating an image. They can also define both positive and negative prompts to ensure the output is to their liking. When this interface is exposed, it allows anonymous users the ability to see the models, nodes, stored prompts, workflows and even to generate their own images with the host’s computing resources. ## Resources for threat intelligence teams Threat intelligence teams looking to assess their own exposure to open ComfyUI instances can search Shodan for [`title:”ComfyUI”`](https://www.shodan.io/search?query=title%3AComfyUI), which returns around 2,800 sites. The vast majority of these are dead ends– approximately 800 return login pages, which can be removed by updating the search to  [`title:”ComfyUI” -title:”Login”`](https://www.shodan.io/search?query=title%3AComfyUI+-title%3A%22Login%22). Aside from the risks of data leakage, those authenticated instances may still be relevant for determining if a vendor is using ComfyUI in some capacity.  Of the remaining 2,000 sites, many are honeypots, require authentication, or are otherwise inaccessible. Ultimately, we found 93 IP addresses allowing unauthenticated access to ComfyUI instances. A further 28 of them timed out while attempting to load the UI and 5 displayed evidence of being honeypots after loading. That left us with 60 unauthenticated ComfyUI servers leaking data and/or available for abuse. The distribution of IP addresses in the Shodan search reveals a concentration in China, which both is and is not misleading. Most of the ComfyUI IP addresses in China are honeypots, but leaking instances disproportionately are hosted in China or use Chinese in their UI settings or file names. These instances are also more likely to be operated by small AI/ML vendors rather than individuals, and thus pose some supply chain risk. ## Risks of exposing ComfyUI  ### Expanded attack surface  Exposing additional services, even with authentication enabled, [increases an organization’s attack surface](https://www.upguard.com/blog/attack-surface-management). In examining the IP addresses where ComfyUI was being hosted, we found they often contained additional services related to the AI generation pipeline. In this example, ComfyUI generated pictures for a clothing retailer on one port while a login interface for a DeepSeek interface somehow related to an RF chip manufacturer was exposed on another. ‍ ### Supply chain The companies operating the ComfyUI workflows often hosted their public website and other business applications on the same IPs. In reviewing these, it was clear that these were not hobbyist instances, but attempts to offer AI image generation as a commercial service. The risk of exposed ComfyUI instances most commonly occurs in the supply chain, as the software permits enterprising individuals to quickly set up image generating pipelines that can then be offered as SaaS services to others. Instances sharing their hardware metadata showed some impressive specs, like a NVIDIA A100-SXM4-80GB GPU with 1 TB of RAM, that indicate either a very rich individual, repurposed cryptominer, or a level of investment commensurate with a small business. ### Prompt leaks ComfyUI embeds image generation metadata in the PNGs it creates. If those prompts contain brand keywords or other internal information, they can be leaked when the images are shared. In one case, the inputs included text prompts and base64-encoded images of real women, both of which could be recovered from the metadata of the generated PNGs. ComfyUI-generated images in the AI supply chain could therefore persist information about the images’ provenance of which corporate consumers might not be aware. Depending on what that prompt data is, it might lead on to our next risk. ### Reputational damage  Even if you are not generating pornography with ComfyUI, other end users of a shared AI image generation vendor might be. If the vendor’s ComfyUI instance is exposed, you might wind up in the uncomfortable position of having your brand associated with that content. The range of content currently being generated on such multi-tenant ComfyUI installations ranges from the innocuous to the extremely unpleasant.  In our survey, we saw four IP addresses generating pornography, usually in the hentai/anime style. Four IP addresses may not seem like very many, but each of those systems was outputting a consistent stream of pornography, resulting in a massive amount of content. On those four IPs we saw dozens of different AI models dedicated to specific explicit scenarios. The existence of such models is not a secret– they can be found even on industry-standard sites like Hugging Face (example and warning: [NSFW](https://huggingface.co/MarkBW/minigirl-penis-xl?not-for-all-audiences=true))– though it can be a little disconcerting to see how much development effort has gone into the creation of resources for mass producing hyper-specific pornography. Why someone would want to produce more pornography than they can possibly consume would require a more psychoanalytical approach than we take in our research, so for now we will leave it as a risk with which you don’t want your business associated.  ### Communications and deepfakes  Somewhat to our surprise, none of the instances we surveyed were creating pornographic deepfakes, at least at the time when we observed them. However, one instance was creating realistic videos of a female Chinese spokesperson in a military uniform. The project used separate workflows to animate her body and face based on models and reference videos in order to match normal human movement for the words she was speaking. At first glance, this project appeared to be creating deepfakes of a Chinese military spokesperson, which would be ripe for abuse, but after translating two of the videos we learned they were announcements related to university events. Still, the ability of anonymous users to edit the prompts could create unintended effects for the consumers of this media. ## Conclusion In the case of data leaking from AI image generation software, we can’t ignore that the risks go beyond preventing the exposure of strictly sensitive data like PII and credentials. The content being created by genAI infrastructure configured for public viewing can erode our perception of, and trust in, that vendor. Exposed ComfyUI interfaces reveal those images, and those images can in turn reveal the prompts used to generate them. They might also reveal other leaks in a vendor’s attack surface, linking the ComfyUI image generation to vendors that appear to offer unrelated services.  Needless to say, if you are using ComfyUI, ensure that authentication is enabled. That risk should be easily treatable. The other risks apparent from surveying these exposures may not be so easy. In several cases, the image generation services were hosted on the same IP addresses as seemingly unrelated businesses, crossing over between manufacturing, consulting, and consumer products. The risk of boutique AI/ML vendors with poor separation of duties between multiple business ventures requires additional diligence from [Vendor Risk Management](https://www.upguard.com/blog/vendor-risk-management) teams, but one that surveying exposed ComfyUI instances can help highlight.  eBook Artificial Intelligence and the Future of TPRM Free resource ### Artificial Intelligence and the Future of TPRM [Download now](/resources/artificial-intelligence-and-the-future-of-tprm) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 26, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)