Internet-facing artificial intelligence systems have exploded in number, with exposed AI infrastructure growing 63% over nine months to nearly 268,000 globally exposed hosts, according to research released by Censys, an Internet infrastructure monitoring company.
The rapid proliferation reflects the speed of AI adoption across organizations, but security researchers say the expansion has outpaced defensive measures. The exposed systems include not just chatbots but backend tools that connect AI to data, applications, and user accounts, creating potential entry points for attackers.
“The Internet is constantly changing, and understanding how it changes is critical to modern cybersecurity,” said Zakir Durumeric, co-founder and CEO of Censys. “New technologies such as AI introduce new layers of infrastructure. Identifying and continuously monitoring Internet-facing systems is essential to realizing AI’s value without introducing unmanaged risk.”
The Censys 2026 State of the Internet Report, the company’s fifth annual assessment, analyzed data from its continuous monitoring of global Internet infrastructure to identify emerging exposure patterns. The research found that n8n, a workflow automation platform, is the most widely exposed AI product at nearly 114,000 hosts, followed by OpenClaw, a personal AI agent assistant, at approximately 54,000 hosts. The United States accounts for 62,687 exposed instances, China for 42,511, and Germany for 31,222.
The findings also document persistent vulnerabilities in industrial control systems. Researchers identified roughly 134,000 Internet-exposed hosts running ICS devices and services globally, with approximately 70% of those found on consumer and mobile networks. This distribution complicates the process of identifying owners and removing exposure. North America accounts for roughly 38% of exposed global ICS infrastructure, followed by Europe at 32% and Asia at 25%.
The report reveals distinct geographic patterns in threat infrastructure. China hosts 36.6% of observed malicious host-level infrastructure like command-and-control systems and remote access tools, compared to 16.8% in the United States. The distribution reverses for web-based threats: the U.S. hosts 45.5% of phishing pages and deceptive sites, while China hosts 20.9%.
Software patching remains uneven across organizations. Researchers studied four commonly targeted products: Progress Telerik Report Server, Jenkins, Cleo MFT, and Microsoft SharePoint Server. While organizations have adopted newer software versions, the oldest versions of these products remained largely unchanged throughout the study period, suggesting that legacy systems continue to pose security risks years after vulnerabilities are disclosed and patches become available.
The findings underscore a growing challenge for security teams: the Internet is becoming more complex and diverse. Organizations deploying AI infrastructure face decisions about how to manage security for new technology moving at unprecedented speed. Meanwhile, longstanding industrial control system exposures persist largely unchanged, decades after such vulnerabilities became well understood.