Dive Brief:

• Hackers could break into businesses by going after internet-exposed AI tools that often contain serious vulnerabilities, the internet monitoring firm Censys warned in a report published on Wednesday.
• The growing complexity of the AI ecosystem — in which public-facing services rely on a sprawling web of back-end products, many of them neglected by security teams — creates additional security risks, researchers said.
• The Censys report also analyzed internet exposures of industrial control systems (ICS), finding that many of them ran traditional IT services that made them more hackable.

Dive Insight:

Roughly 268,000 internet-connected devices are running AI products, according to Censys’s report, which identified 44 distinct products ranging from workflow automation tools to AI assistants and large language model gateways. The vast majority (82%) of those devices are running five popular products, including the workflow automation platform n8n, the personal assistant tool OpenClaw and the chatbot front-end interface Open WebUI.

The data highlight how convoluted the AI environment has become, which is one of the major factors that makes it difficult to secure.

“There’s already a characteristic AI infrastructure stack emerging on the Internet,” Censys analysts wrote in their report. “It’s not just exposed LLM interfaces or models, but all of the other layers of supporting infrastructure used to build and operate AI applications and workloads.”

Each of the most widely exposed AI tools carries different risks if exploited, Censys said. It pointed to a major vulnerability in OpenClaw that could have allowed arbitrary code execution on a host machine, as well as the privileged position that n8n occupies as an AI orchestration tool, meaning that a compromise of the tool could have major downstream consequences. N8n, too, had “a very busy year on the vulnerability front,” the report said, including a serious arbitrary file-read vulnerability.

“The attack surface grows not simply when another AI application is deployed,” Censys said, “but when each layer supporting that application becomes independently reachable from the Internet, and therefore something that needs to be secured.”

The number of internet-exposed AI tools surged 63% between October 2025 and June 2026, with a peak in early 2026 of nearly 300,000 endpoints.

The plurality of the internet-exposed services were in the U.S. (62,687 IP addresses), followed by China (42,511) and Germany (31,222), with those three countries accounting for slightly more than half of all exposures. Cloud service providers accounted for the largest share of exposures, with roughly 32,000 appearing on Amazon’s infrastructure alone. In what Censys called a notable finding, the top five cloud providers shared roughly the same amount of exposure.

Large numbers of ICS devices are also accessible from the internet, according to the Censys report. The company’s public scans identified roughly 134,000 ICS devices in early 2026, a roughly 4% increase from the figure in 2024. More than 80% of those devices are running at least one non-ICS function in addition to their primary role, including HTTP and FTP servers, which creates additional intrusion risks. A hacker “doesn’t necessarily have to understand” esoteric ICS protocols if they can instead breach a target machine through a simpler IT protocol, Censys observed.

One troubling finding in the report is that roughly 70% of exposed ICS devices are running on mobile or consumer networks, which makes it more difficult to identify and warn their operators. Industrial devices using cellular modems are likely to be in remote areas, where they are also unlikely to receive frequent security updates.

Policymakers and security experts are paying more attention to the digital vulnerabilities in U.S. critical infrastructure following Iran-linked hacks of water systems and multiple China-linked hacking campaigns against various sectors.

In some countries, one telecommunications company hosts the vast majority of exposed ICS devices, creating a serious concentration risk. In Turkey, 81% of internet-accessible devices use one mobile provider; in South Korea, one carrier hosts 71% of devices. “Homogeneous hosting patterns like these can increase risk,” Censys said. “Armed with the knowledge that the bulk of a country's critical infrastructure can be found on a single network, reconnaissance and hunting are made more straightforward for threat actors.” In the U.S., the exposure was more dispersed — Verizon hosted one-third of internet-accessible devices, while the rest were spread across multiple networks.

North America accounted for roughly 38% of all the exposed ICS devices that Censys identified, followed by Europe (32%) and Asia (25%).