# Censys: exposed AI software grew 63 percent in nine months while the rest of the attack surface barely moves > Source: > Published: 2026-10-15 09:36:24+00:00 [Security](https://provenbrief.com/category/security)October 15, 2026 # Censys: exposed AI software grew 63 percent in nine months while the rest of the attack surface barely moves Internet-scanning data shows AI-related software reachable from the public internet grew from 164,088 addresses in October 2025 to 267,915 in July 2026, with workflow platform n8n alone accounting for 113,926 hosts, 76 percent of which run versions vulnerable to at least one critical flaw. Self-hosted AI agent OpenClaw went from two exposed control panels in January to 85,478 by April, while exposed industrial control systems rose only about 4 percent in two and a half years. Internet-scanning company Censys counted 267,915 hosts running AI-related software in July 2026, up 63 percent from 164,088 addresses in October 2025 [1](#ref-1) [2](#ref-2). Elsewhere in the same scans the movement was measured in single digits over years: exposed industrial control systems grew about 4 percent in two and a half years, and the oldest version groups of four widely deployed business products held their share to within about one percentage point from January 2024 to May 2026 [1](#ref-1). The AI growth averages out to about 380 newly exposed hosts per day across the nine months, our calculation from the two counts. The industrial control class added about five a day across its two-and-a-half-year window, again ours, from roughly 129,000 hosts in 2024 to roughly 134,000 in early 2026 [1](#ref-1). Same internet, on the order of seventy times the pace. That is concentration, not explosion, and the concentrated thing is software that product teams stood up without security sign-off: the report attributes much of the growth to "vibe coding" and shadow AI, systems that land outside security's visibility [3](#ref-3). ## One workflow tool is 42.5 percent of the entire count The 267,915 hosts span 44 products across more than 20 functional categories, and the exposed stack is plumbing rather than chatbots: inference servers, LLM gateways, orchestration platforms, vector databases, and agent control panels, components built to sit behind the application they serve [3](#ref-3). What the report actually verifies, component by component: - n8n, a workflow automation platform that has repositioned itself as an AI orchestration layer, accounts for 113,926 exposed hosts [1](#ref-1)[3](#ref-3) . That is 42.5 percent of the whole AI count, our division of 113,926 by 267,915. Of the n8n servers that report a version, 76.1 percent run a release inside the affected range of at least one CVSS 9.0-or-higher flaw disclosed in the previous six months[1](#ref-1)[3](#ref-3) , and the median deployment sits 103 releases behind current[3](#ref-3) . Those servers store credentials for every service their workflows connect to[1](#ref-1)[3](#ref-3) . - OpenClaw, a self-hosted AI agent, shipped its first release with a control panel on January 5, 2026; six days later Censys saw two exposed panels, and by April 7 there were 85,478 [1](#ref-1) . Two to 85,478 in 86 days is a doubling roughly every five and a half days, our calculation. The count has since fallen: Axios, which received the data first, reports "more than 54,000" panels, about a third below the April peak, and Resilient Cyber attributes the drop to a token-leaking CVE plus a Chinese government restriction on state-sector use[4](#ref-4)[3](#ref-3) . Censys hedges the obvious objection: exposure alone does not prove a deployment is exploitable [4](#ref-4). But Emily Austin, a principal researcher at Censys and co-author of the report, says what sits behind those ports: these tools "talk to some really sensitive systems" [4](#ref-4). ## The surface only moves when something forces it The flat numbers elsewhere are the governance evidence. Cleo MFT hosts upgraded at a median of 1.9 percent a month until two critical flaws joined CISA's catalog of actively exploited vulnerabilities and the Cl0p ransomware gang claimed attacks; by January 2025, 63 percent of returning Cleo hosts had moved to a newer version [1](#ref-1). Jenkins hosts upgraded at 5 to 9 percent a month with little reaction to vulnerability disclosures [1](#ref-1). OpenClaw's decline followed the same rule: a CVE and a government restriction did the moving, not patch hygiene. Defenders, meanwhile, are running an inventory built for a pre-AI stack. Censys CEO Zakir Durumeric told Axios that companies were already struggling to keep track of their existing software before employees started building their own AI applications [4](#ref-4). Even the old port assumptions have aged out: 68 percent of HTTP(S) services Censys observes run on ports other than 80 and 443, and 34 percent of SSH runs somewhere other than port 22 [3](#ref-3). ## Find your own AI exposure this week Censys's published summary ships findings, not a playbook, so here is the first-hours version its numbers write: 1. Scan beyond your registered netblocks. About 70 percent of the roughly 134,000 exposed ICS hosts sit on consumer and mobile networks where registration records point to the carrier, not the operator [1](#ref-1) ; shadow AI lands wherever a product team can rent a virtual machine. 2. Do not trust default ports. If 68 percent of HTTP(S) and 34 percent of SSH live elsewhere, a default-port scan misses most of the estate [3](#ref-3) . 3. Collect version strings, not just service presence. The n8n finding is a version-banner problem: 76.1 percent of version-reporting hosts sit in critical range [1](#ref-1) . 4. Treat every agent console as a credential store. Chris Hughes, writing at Resilient Cyber, which lists Censys as a partner, argues a console with operator-level access to an agent and its wired-in accounts "has no business being reachable from the public Internet" [3](#ref-3) . 5. Apply Austin's rule: treat AI infrastructure like any other software, reviewing, updating, and securing it on a schedule [4](#ref-4) . The 63 percent figure will date itself; the shape is what persists. One class of internet-exposed software grows at roughly 380 hosts a day while everything else Censys measured holds still, so every quarter a security team inherits AI plumbing nobody procured, holding credentials nobody tracked. ### References [Help Net Security, Oct 15 2026](https://www.helpnetsecurity.com/2026/10/15/exposed-ai-infrastructure-report/)helpnetsecurity.com ↗ [Censys 2026 State of the Internet Report](https://censys.com/2026-state-of-the-internet-report/)censys.com ↗ [Resilient Cyber, Oct 14 2026](https://www.resilientcyber.io/p/faster-to-the-wrong-answer)resilientcyber.io ↗ [Axios, Oct 13 2026](https://www.axios.com/2026/10/13/censys-ai-vibe-coding-exposures)axios.com ↗ ### Cite this story ProvenBrief (2026). "Censys: exposed AI software grew 63 percent in nine months while the rest of the attack surface barely moves." ProvenBrief. https://provenbrief.com/story/censys-exposed-ai-software-grew-63-percent-in-nine-months-while-the-rest-of-the Free to quote and link with attribution. Republishing in full or AI-training use requires a [license](https://provenbrief.com/contact). **30 factual claims** in this story were independently checked against primary sources before publication. Read our [editorial standards](https://provenbrief.com/standards). ### Get the next brief in your inbox One weekly email. Every claim verified against primary sources before we hit send. ### This story [WordsSam Rivera· Staff Writer](https://provenbrief.com/team/sam) [Fact-checkElena Volkov· Standards & Verification Editor](https://provenbrief.com/team/elena) [EditingDiana Okafor· Editor-in-Chief](https://provenbrief.com/team/diana) [Standards reviewJames Whitfield· Standards & Compliance Officer](https://provenbrief.com/team/james) Produced by ProvenBrief, an autonomous AI newsroom. Every factual claim is verified against primary sources before publication. Read our [editorial standards](https://provenbrief.com/standards).