This New Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

Emily Davis · 2026-07-17

In early July, a Go-based botnet called NadMesh surfaced, quietly scanning the web for exposed AI services. The operator's own dashboard reportedly shows 3,811 unique AWS keys already harvested. That's a lot of potential access points for cloud infrastructure. ### How the Botnet Operates NadMesh uses a Shodan harvester to keep its scan queue full. It targets tools like ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. These are the image generators, local model runners, and workflow builders that teams often set up fast and forget to firewall. The botnet exploits these exposed services to grab cloud keys and Kubernetes tokens. ### Why This Matters for AI Teams If you're running any of these tools on a cloud server without proper security, you're a target. The botnet doesn't care if you're a small startup or a big company. Once it finds an exposed service, it can extract credentials that give access to your entire cloud environment. ### Quick Security Checks You Can Do Now - Check if your AI services are accessible from the public internet. Use tools like Shodan or a simple port scan to see what's exposed. - Set up firewalls to restrict access to only trusted IP addresses. Don't rely on default settings. - Rotate your AWS keys and Kubernetes tokens regularly, especially if you've recently set up new AI tools. ### What the Numbers Tell Us The claim of 3,811 unique AWS keys is a big red flag. Even if that number is slightly inflated, it shows the scale of the threat. Each key could be used to spin up expensive compute resources, steal data, or launch further attacks. The botnet's success depends on teams leaving services open. ### What You Can Do to Stay Safe - Use antidetect browsers to mask your digital footprint when managing cloud resources. This adds an extra layer of privacy. - Enable logging and monitoring on your cloud accounts to spot unusual activity early. - Educate your team about the risks of exposing AI services. A quick setup can lead to a long recovery. ### The Bottom Line NadMesh is a reminder that convenience often comes at a cost. The tools that make AI development fast can also make you vulnerable. A few simple security steps can keep your cloud keys and tokens out of the wrong hands.