Internet-Exposed AI Systems Up 63% in Nine Months, Censys Data Shows

The amount of AI-related infrastructure sitting on the public internet jumped 63% in nine months, according to new data from the security firm Censys shared first with Axios.

Censys identified nearly 268,000 internet-facing systems running 44 different AI-related products as of July. In October 2025, the count was roughly 164,000.

These are not chatbots. They are the plumbing: software that connects AI models to databases, corporate applications and other services.

Where the exposure is concentrated

The most widely exposed product was n8n, a workflow automation platform that can connect AI agents to other applications. Censys found nearly 114,000 internet-facing n8n deployments.

About 77,000 of them were running software versions affected by at least one recently disclosed critical vulnerability. That is roughly two in three.

Researchers also found more than 54,000 exposed control panels for OpenClaw, an open-source AI agent that users can connect to personal accounts and other services.

"It's a little bit beyond just like the tool itself, but these [tools] talk to some really sensitive systems," Emily Austin, a principal researcher at Censys and co-author of the report, told Axios.

Those systems can include emails, financial records and internal databases. An exposed connector is a possible way in to all of them.

The inventory problem

Censys CEO Zakir Durumeric told Axios that companies were already struggling to keep track of their existing software before employees started building their own AI applications. Cheap, easy hosting makes the problem worse. Anyone can stand up an AI app in an afternoon, and IT may never hear about it.

Surveys of company leaders point the same direction. An EY Technology Pulse Poll published earlier this year found that more than half of department-level AI initiatives lacked formal approval or oversight. UpGuard, a cyber risk monitoring firm, found more than eight in ten employees use unapproved AI tools at work. A New Relic report found one in four AI agents operate without oversight in enterprise environments.

A Workato survey of IT leaders adds a harder number. Six in ten respondents said they worry more about AI agents than about cyberattacks. And 36% said they would try to quietly handle an agent-driven security incident without disclosing it.

"IT leaders are in a double bind," Workato CTO Adam Seligman said in a press release. "They are pushed to roll out increasingly powerful AI, yet they can't fully control it, and they are on the hook when it goes wrong."

That 36% figure is a survey response about intent, not a count of concealed breaches. Still, it is a number worth a board's attention. A company that hides an incident from customers and regulators has made a choice, and it will answer for it.

The caveat Censys itself attaches

The Censys findings do not establish whether those deployments are actually vulnerable to exploitation. An exposed server is not a hacked server. A version flagged as affected by a critical flaw may have mitigations in place. The report measures attack surface, not breaches.

Censys's own recommendation is plain. Austin said companies need to treat AI infrastructure like any other software they deploy, with regular review, updates and securing.

Members of the Forbes Technology Council make a similar argument about autonomy. Shahir Daya of Zafin wrote that as AI agents move from recommending to executing, organizations need "clear permissions, policy-based authorization, approval thresholds and audit trails."

A separate case of exposed data

A concrete example of what careless AI-era hosting looks like came from researcher Jeremiah Fowler. He found a database holding 13.7 million records with no encryption or password protection.

Fowler linked the IP address to a data intelligence platform associated with Vibetech, an IT services and AI software development firm based in India. The database collected credentials from earlier breaches, including datasets tied to the AT&T breach and the FBI employee directory breach, and made them available without authentication.

The records were previously breached, which raises the obvious question of whether re-exposure matters. Security Magazine's account of the discovery says it does. Gathering them into one searchable repository makes them easy for criminals to use, and old credentials can keep their value for years.

It is unclear whether anyone malicious accessed the database before Fowler found it. Vibetech's response has not been reported.

The open question for companies is simple. Most security teams cannot say how many AI tools and agents employees connected to company data last month, and the Censys count suggests the number outside corporate control is still growing.