Estimated reading time: 5 minutes
Exposed AI infrastructure grew 63% in nine months, Censys finds. The most exposed product, the n8n automation platform, stores the credentials for the systems it connects. Most exposed n8n servers run a release with at least one critical flaw. Cyber insurance underwriters can see them from outside.
Exposed AI infrastructure is growing fast. Censys counted 267,915 servers exposing AI-related software in July 2026, up 63% from 164,088 in October 2025.
Most of it is not chatbots. It is the plumbing behind them: model servers, gateways, vector databases, and the tools that wire AI into everything else.
The figures come from Censys’s fifth annual State of the Internet Report. Censys scans the entire public IPv4 address space and sells exposure management and threat-hunting tools. Its report notes that exposure alone does not prove a system is vulnerable or compromised.
Exposed AI Infrastructure That Holds The Keys
One product dominates. Censys found 113,926 internet-facing servers running n8n, more than twice the next product, the OpenClaw agent assistant.
n8n began as a workflow automation platform and now markets itself for AI orchestration. It connects tools like Slack, Google Drive, and databases to AI models. It also stores the credentials it uses to reach them.
A compromised n8n server “can expose far more than the platform itself,” Censys says.
n8n Vulnerabilities At Scale
Censys could read the software version on 89% of exposed n8n servers. Of those, 76% ran a release affected by at least one critical flaw. Censys counted flaws rated 9.0 or higher on the CVSS scale and disclosed between December 2025 and May 2026. Some of those flaws need particular settings to work. Excluding them, the figure is 75.9%.
The median server was 103 releases behind the latest version, about four months. Sixty-seven percent exposed n8n’s service port directly, without a protective proxy in front of it. More than 80 n8n vulnerabilities came to light in about nine months.
The add-on ecosystem carries risk too. In January, attackers published malicious n8n add-ons posing as legitimate integrations. At least eight harvested credentials during workflows, Censys says.
What Outside-In Scanning Shows Cyber Insurance Underwriters
Many organizations may not know these tools are running, Censys says. AI coding assistants let developers stand up software in an afternoon, often with permissive settings. Censys calls the result “shadow AI.”
A proposal form only captures what an applicant knows and declares. KYND launched AI detection last month to find AI on an organization’s external footprint without asking. Censys’s data shows the scale of what such scans can find.
“Anything Censys can see, a threat actor conducting reconnaissance can see as well,” the report says.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
Old Software Lingers Until Attackers Arrive
Censys also tracked four widely deployed products for two and a half years. They were Progress Telerik Report Server, Jenkins, Cleo MFT and self-hosted Microsoft SharePoint Server. Middle-aged versions faded. Telerik 7.x, from 2021, fell 52.9 percentage points as a share of exposed servers. The oldest versions of all four barely moved, changing by roughly 1 percentage point or less.
Cleo’s file-transfer software shows what moves the rest. Before late October 2024, a median 1.9% of returning Cleo servers upgraded each month. A critical flaw’s disclosure then pushed the rate to 38.4%. After a second fix and reports of active exploitation, 63% upgraded by January. The Clop ransomware gang later claimed responsibility for exploiting the flaw against multiple organizations.
As Chainguard’s survey found this week, many organizations knowingly leave flaws open. Censys’s data shows the result from outside. Patching surges once attackers move, and the oldest systems never move at all.
FAQ – Exposed AI Infrastructure
How fast is exposed AI infrastructure growing?
Censys counted 267,915 internet-facing servers running AI-related software in July 2026, up 63 percent from October 2025.
What is n8n?
A workflow automation platform now used to orchestrate AI. It connects apps, databases and AI models, and stores the credentials to reach them.
How many exposed n8n servers are vulnerable?
Of exposed n8n servers with a readable version, 76 percent ran a release affected by at least one flaw rated 9.0 or higher on the CVSS scale.
Does exposure mean a server has been hacked?
No. Censys says exposure alone does not prove a system is vulnerable or compromised. Its vulnerability figures are based on software versions.
Why does this matter to cyber insurers?
Outside-in scans can see these servers without asking the applicant. A compromised orchestration server can expose every system whose credentials it stores.
Do organizations patch old software?
Middle-aged versions get updated. Censys found the oldest versions of four products barely changed over two and a half years.
Related Cyber Insurance Posts
- Half Of Security Leaders Knowingly Leave Critical Flaws Open. Insurers Ask About That.
- Censys–Rilian Deal Boosts Middle East Critical Infrastructure Cybersecurity Amid Rising State-Linked Threats(Opens in a new browser tab)
- Cybersecurity Gap: Why SMEs Must Catch Up to Large Organizations in Cyber Resilience(Opens in a new browser tab)
- Silent Push 6.0 Gives Cyber Underwriters Sharper Threat Intelligence(Opens in a new browser tab)
- Lumen Warns Edge Device Security Risks Now Define Cyber Risk Exposure(Opens in a new browser tab)