Exposed AI Systems Surge 63 Percent in Nine Months, and the US Leads the Count, Censys Finds
Artificial intelligence is no longer confined to a chat window. It now sits behind automation tools, agent assistants, and the connectors that link apps to data and business systems. A new Internet-wide survey shows how much of that machinery is visible from the open Internet, and the United States accounts for the largest share.
According to Censys, nearly 268,000 internet-facing AI systems were identified in its 2026 State of the Internet Report. That total represents a 63 percent increase in nine months. The report is the fifth annual edition from the Censys Advanced Research Collective, and it draws on historical and real-time data from the Censys Internet Map, which continuously monitors global Internet infrastructure.
The headline number is not only about chatbots. Censys says the systems it counted include the tools that connect AI applications to data, business systems, and user accounts. When that supporting machinery is left facing the public Internet without proper controls, it can become an entry point for attackers, even if the main application looks secure.
The United States accounts for the largest share
The United States accounted for 62,687 exposed AI systems, more than any other country in the study. China followed with 42,511, and Germany followed with 31,222. Together, the three countries represented just over half of the observed AI infrastructure, according to the report summary.
That ranking partly reflects scale, since the United States also hosts a large share of the world's cloud infrastructure and AI experimentation. Still, it puts a concrete number on a risk: AI deployments are spreading faster than the inventories meant to track them.
For readers in the US, the practical point is simple. If a company, a school, a local agency, or even a hobby project has set up an AI tool, an automation workflow, or an agent that can act on data, someone should be able to answer basic questions about it. What is it connected to? Who can reach it from the Internet? Does it require sign-in? If no one can answer with confidence, the system may be part of the exposure Censys measured.
Two products dominate the exposed list
Workflow automation platform n8n was the most widely exposed product in the study, with nearly 114,000 hosts. OpenClaw, a personal AI agent assistant, followed with approximately 54,000 hosts. Together, those two products account for a large share of the nearly 268,000 systems identified.
That concentration matters because it shows where everyday AI use is actually happening. n8n is used to automate tasks across apps and services, which means an exposed instance can sit close to calendars, messages, files, and business tools. An agent assistant, by design, can take actions on a user's behalf, which makes access control and authentication even more important.
Censys chief executive Zakir Durumeric put the lesson in plain terms in the report summary: identifying and continuously monitoring Internet-facing systems is essential to realizing AI's value without introducing unmanaged risk. The point is not to stop using automation or agents. It is to treat them like any other system that touches real data, with an owner, a login requirement, and a plan for updates.
Industrial systems and old software remain exposed too
The report also found approximately 134,000 internet-exposed hosts running industrial control system devices and services. North America accounted for around 38 percent of the observed industrial exposure, followed by Europe at 32 percent and Asia at 25 percent. About 70 percent of these exposed hosts were consistently found on consumer and mobile networks, which Censys says makes ownership identification and remediation more difficult.
Industrial control systems help run physical processes in sectors such as manufacturing, energy, and water. Most were never designed to sit directly on the public Internet, and exposure does not automatically mean an attacker can take control. It does mean the system is visible and reachable in a way that invites probing, and that defenders may struggle to find the right owner to fix it.
Threat patterns differ, and the US leads web threats
The report also mapped threat infrastructure, and the patterns varied by type. China hosted 36.6 percent of the malicious host-level infrastructure observed by Censys, including command-and-control systems and remote-access tooling, compared with 16.8 percent in the United States. For web-based threats, such as phishing and deceptive pages, the balance flipped: the United States accounted for 45.5 percent of observed web-based threats, while China represented 20.9 percent.
What US businesses and users should do
The report does not name individual victims, and it does not claim that every exposed system was breached. Its value is as a map: AI infrastructure is growing fast, it is often reachable, and the United States sits at the center of that map.
For a small business or a team, the response can start with an inventory. List every AI tool, automation platform, and agent in use, including free trials and personal projects connected to work accounts. Check whether each one requires a strong login, whether it uses two-factor authentication where available, and whether its admin pages are open to the Internet or restricted to trusted users. Remove anything no longer needed, and change any shared or default credentials.
The 63 percent jump in nine months is a warning about speed. AI adoption is not slowing, and neither is the infrastructure that supports it. The organizations that keep pace will be the ones that can say, at any moment, what they have exposed, who can reach it, and why it needs to be there at all.
Post Comment