AI Is Building a New Internet Attack Surface Faster Than Security Can Keep Up

Nearly 268,000 internet-facing systems are now exposing AI-related infrastructure, according to Censys. The big concern is not just how big the number is, but what these systems are connected to.

[For more news, click here]

In the past 2 years, enterprises have discussed concerns about AI models leaking information and being manipulated. However, the main challenge now is that AI is developing its own infrastructure layer. When models sit behind workflow engines, agent platforms, and inference servers, they connect AI directly to company data, credentials, and business applications.

Censys' 2026 State of the Internet Report identified 267,915 IP addresses exposing at least one of 44 AI-related products by July 2026, up from 164,088 in October 2025. That represents growth of more than 63% in just nine months.

Internet facing layer in AI is considerably messy. Censys found everything from workflow automation and personal AI agents to model inference services, LLM gateways, RAG systems, vector databases and development tools. Five products alone appeared on 82% of the AI-related hosts observed. They included n8n, OpenClaw, New API, Ollama and OpenWebUI.

A compromised chatbot is one route into an application but an exposed orchestration platform can occupy a privileged position. The more useful agents become, the more access they have. That makes the infrastructure coordinating those agents more prone to attacks.

Censys observed 113,926 internet-facing n8n deployments, making it by far the most exposed AI-related product in its dataset. Originally built as a workflow automation platform, n8n has expanded into AI orchestration, connecting agents, model providers, vector stores and external services.

Censys also found that 67% of exposed n8n instances had the platform’s port 5678 directly reachable while another 970 exposed adjacent ports.

More than three quarters of versioned n8n hosts observed by Censys fell within the affected range of at least one vulnerability with an NVD-assigned CVSS score of 9.0 or higher disclosed between December 2025 and May 2026. Even after excluding vulnerabilities requiring additional conditions, the figure remained 75.9%.

Censys also points out that internet exposure does not automatically mean a system is compromised. An exposed service may have other protections in place. One of the key takeaways from this research is that AI security can no longer be treated as a single product category.

Censys CEO Zakir Durumeric puts the issue around visibility rather than simply vulnerability: "New technologies such as AI introduce new layers of infrastructure. Identifying and continuously monitoring Internet-facing systems is essential to realizing AI's value without introducing unmanaged risk."

What this research highlights is that the next major AI security failure may not begin with someone attacking the model. It might start several layers beneath it, inside the ordinary looking infrastructure connecting the model to everything that makes it useful.

Related Articles

AI Makes Up About a Quarter of Software Spending in Pemo's UAE SME Index

Exclusive: Microsoft’s Medical AI Outperformed Doctors. What Happens Next Matters More

Sandbox the code. Govern the workflow.