29 minutes. Not the problem.
Per The Hacker News, a new Go botnet called NadMesh emerged in early July, targeting exposed AI services like ComfyUI and Ollama, as reported by Matrice Digitale. The operator's dashboard claims 3,811 unique AWS keys stolen.
According to Matrice Digitale, NadMesh also targets n8n, Gradio, and other services, aiming to steal AWS keys, Kubernetes tokens, and AI inventories. The Hacker News notes that a Shodan harvester keeps the scan queue stocked with these vulnerable services.
What everyone reads as a simple botnet issue is actually an exposure problem. As per the data, 42% of breaches involve the human element, according to Verizon DBIR 2025. The defensive math: -> Implement a 14-day review cycle for all newly exposed services, focusing on AI and cloud keys. -> Use a Shodan-like scanner to find and fix exposed ComfyUI, Ollama, and n8n instances within the next 30 days, reducing the attack surface. -> Conduct an AWS key rotation within 60 days, ensuring no keys are older than 90 days, as recommended by CrowdStrike.
When did your team last audit the exposure timeline of your AI services?