Censys report finds growth in internet-exposed AI infrastructure

Censys released its fifth annual State of the Internet Report on October 14, 2026.[1] It reported that internet-exposed AI infrastructure grew 63% over nine months.[1] As of July, the company counted nearly 268,000 internet-facing systems running 44 different AI-related products, compared with roughly 164,000 systems in October 2025.[2] The figures point to a larger set of externally reachable AI tools for security teams to account for, rather than only highly visible AI applications. The report’s totals describe internet-facing systems, not confirmed compromises.[3]

Among deployments whose software versions could be identified, 76% ran versions within the affected range of at least one recent critical vulnerability.[3] That percentage applies only to the deployments with identifiable versions; it does not establish that all n8n deployments were vulnerable. Censys also found more than 54,000 exposed control panels for OpenClaw, an open-source AI agent users can connect to personal accounts and other services.[2] The report says orchestration tools can link AI to business systems, data and credentials.[3]

Censys cautioned that an internet-facing system is not necessarily insecure.[3] It said, however, that exposed AI tools can raise the consequences of a compromise because they may connect to credentials and other business services.[3] Five popular products, including n8n, OpenClaw and Open WebUI, accounted for 82% of internet-connected devices running AI products in the report.[4] The concentration may help teams prioritize reviews of widely deployed tools, while still requiring them to verify their own systems’ versions, configurations and connections rather than infer risk from product name or exposure alone.

Censys found that 68% of HTTP(S) services ran outside their default ports.[3] For SOCKS proxies, checking only the default port would reveal 4% of the observed population, according to the company.[3] Censys continuously maps the global internet and tracks changes to online infrastructure and services.[3] The report also examined industrial control systems: it identified roughly 134,000 internet-connected ICS devices in early 2026, about 4% more than in 2024.[4] More than 80% ran at least one non-ICS function, and roughly 70% ran on mobile or consumer networks.[4]