1. Exposed AI infrastructure grows by more than 60 percent
Internet intelligence firm Censys says the amount of exposed AI infrastructure reachable from the public internet has climbed by more than 60 percent in nine months. Its 2026 State of the Internet findings count over 294,000 distinct IP addresses running 43 AI and large language model tools, up from about 183,000 in October 2025, with Langflow and LiteLLM growing fastest.
The figures point to a gap between how quickly organizations are putting AI software into service and how carefully that software is being locked down. Systems left open to the internet can be found by anyone running a scan, including attackers, and the pattern Censys describes is one in which deployment is running ahead of protection.
Two of the most widely used platforms in the dataset, Langflow and LiteLLM, both carry serious vulnerabilities, and some of those flaws are already being exploited in real attacks. That combination, rapid growth plus known and actively used weaknesses, is what makes the numbers more than a simple count of servers.
2. What does Censys measure?
Censys is a firm that maps what is visible from the open internet and sells attack-surface management tools, meaning products that help organizations see which of their systems an outsider could reach. Its scanners continuously probe internet addresses and record the services that answer, which allows it to track how technologies spread over time.
In that view of the internet, AI software has become a dominant category. The company's count of 294,000 addresses refers to distinct public IP addresses on which at least one of 43 tracked AI or LLM tools is running. Comparing that figure with roughly 183,000 addresses in October 2025 yields growth of a little over 60 percent, which is the basis for the nine-month trend.
It is worth being clear about what exposed means. An exposed tool is one that can be reached over the public internet. That is not the same as a tool that has been breached, and many exposed instances may be properly protected by logins or other controls. The concern is that every reachable system is a potential target, and any that lack protection or run vulnerable versions can be attacked without the owner noticing.
3. Why is Langflow a concern?
Langflow, a platform for assembling AI workflows, saw the number of exposed instances rise 169 percent over the nine-month period, the fastest growth among the tools highlighted by Censys. Tools of this type let developers connect models, data sources and actions into pipelines, which means a compromised instance can give an attacker a foothold into the systems it is connected to.
The platform also has a notable security record. Between 2024 and 2026, 18 Common Vulnerabilities and Exposures entries, the standardized identifiers used to track publicly disclosed flaws, were reported for Langflow. Fourteen of them carry a CVSS score above 8.0. CVSS, the Common Vulnerability Scoring System, rates severity on a scale of zero to ten, and scores above 8.0 fall in the high or critical range.
Four of the Langflow flaws are listed in the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency, or CISA. Inclusion in that catalog means there is evidence that attackers have used the weakness in real incidents, which separates those four from vulnerabilities that exist only in theory.
4. What is the LiteLLM vulnerability?
LiteLLM, a tool that lets applications talk to many different AI models through a single interface, grew 97 percent in the same period, nearly doubling its exposed footprint. Censys notes that it is affected by an actively exploited pre-authentication SQL injection flaw tracked as CVE-2026-42208.
A SQL injection flaw lets an attacker feed specially crafted input to an application so that it runs unintended database commands. The term pre-authentication means the attacker does not need to log in first, which lowers the barrier considerably. Because the vulnerability is described as actively exploited, defenders should treat it as an immediate priority rather than a future risk.
Tools like LiteLLM often sit in front of several AI providers and may hold the credentials used to reach them. A successful attack on such a gateway can therefore expose more than one system at once, which is why weaknesses in this layer receive particular attention from security teams.
5. Why do AI tools create security risk?
Most AI tools are built to be connected: they accept requests from users and other programs, call outside services, and often store keys or tokens that unlock paid model access. A workflow builder or model gateway is therefore a convenient target, because one compromised service can hand an intruder access to many others.
Many of these projects are also open-source and evolve quickly. Rapid releases bring useful features, but they can also introduce flaws, and organizations that install a tool once and never update it will fall behind on fixes. The Censys data reflects both sides of this pattern, with adoption growing sharply while the vulnerability lists for the leading platforms lengthen.
Large language models, the systems behind modern chatbots and assistants, add a further dimension. They are frequently wired into company data and given the ability to take actions, so the surrounding software has to be trusted to enforce limits. When that software is exposed and flawed, the protections around the model matter less than the weakness beneath it.
6. Is AI being deployed faster than it is secured?
That is the conclusion the Censys numbers support. The growth in exposed tools shows many organizations have put AI software on the internet quickly, while the vulnerability records of two leading platforms show that attackers are already exploiting known, high-severity bugs in the same software.
Speed of adoption is understandable. Businesses are racing to build assistants, automated workflows and internal tools, and many of these projects begin as experiments run by individual teams. Experiments are often launched with default settings and without review by a central security group, and they can remain online long after their creators have moved on.
The result is a larger attack surface, the total set of points through which an unauthorized party could try to enter a network. Each new AI service adds to that surface, and the Censys data suggests it has expanded by well over half in less than a year.
7. What can defenders do?
The Known Exploited Vulnerabilities catalog offers a practical starting point. With 14 high-severity flaws recorded for Langflow, security teams face a long list, but the four that appear in the CISA catalog are the ones attackers are known to use. Fixing those first is a way to reduce risk quickly without waiting to address every issue.
Beyond patching, organizations can take stock of which AI tools they actually run and which are reachable from outside. An inventory is the precondition for everything else, since a system that no one knows exists cannot be updated or protected. Placing tools behind authentication and removing unneeded internet exposure are standard measures that apply here as they do elsewhere.
For the security market, the findings underline demand for products that discover and monitor AI deployments, since many of these tools are installed informally and may not appear in conventional asset records.
8. What does this mean for companies and the security market?
For companies, the practical message is that AI projects deserve the same scrutiny as any other internet-facing system. That means assigning owners to each deployment, tracking which versions are running, and applying patches promptly when a vulnerability is added to a catalog of exploited flaws.
The numbers also bear on the cybersecurity industry. As the count of exposed AI systems rises, vendors that discover, inventory and monitor such systems have a growing pool of customers who need visibility they do not currently have. Attack-surface management, the field in which Censys operates, becomes more relevant when new categories of software appear faster than internal teams can track them.
Insurers, auditors and regulators may take notice as well. A measurable increase in reachable, vulnerable systems gives them a concrete indicator to use when assessing how well organizations are managing the risks of adopting AI.
9. What comes next?
Censys has said the findings are part of its 2026 State of the Internet work, which also covers industrial control systems and other threat infrastructure rather than AI alone. The firm has published early findings in the months before the full report, and further detail from that work may add to the picture.
The next meaningful signals will be whether exposure keeps growing at this pace and whether the flaws in Langflow and LiteLLM are patched across the instances that remain reachable. If deployment continues to outrun security, the number of vulnerable systems visible to attackers will keep rising, and the gap between the two will be the metric to watch.
Until then, the findings serve as a reminder that visibility is the first step in defense. Organizations that know which AI tools they run, where those tools can be reached and which versions are installed are in a far better position to respond when the next vulnerability is disclosed. Those that do not may learn about their exposure only after an attacker has found it, and with scanning tools freely available, the time between a system going online and being discovered can be short. Regular reviews of what is reachable from the internet, repeated as new tools are added, help close that window.