A new Go-based botnet named NadMesh has emerged, actively scanning for and exploiting exposed AI services. The botnet’s operators claim to have harvested over 3,800 unique AWS keys. It targets popular AI platforms like ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio, which are often deployed quickly without adequate security. This activity underscores the growing risk to AI infrastructure from misconfigurations and exposed services.