Mysterium VPN has counted 36,769 self-hosted AI endpoints reachable from the open internet, and found that only 741 of them, 2.02%, return an HTTP authentication challenge. The research, published on 10 September 2026, covers model servers, agent builders and vector stores. Its authors describe the total as a floor rather than a ceiling, and independent scans published earlier this year support that reading.
The finding is not that a particular product is insecure. It is that an entire category of software is being deployed with no network perimeter at all: no reverse proxy asking for credentials, no VPN, no gateway, no IP allowlist. The default posture for self-hosted AI in 2026 is open.
What the research counted
The team queried Netlas.io’s public internet-wide scanning index on 30 and 31 August 2026, matching HTTP response bodies and page titles against fingerprints for each product. Ollama, for example, was identified by the plaintext string it returns to an unauthenticated request. The full methodology and the per-product fingerprints are published in Mysterium VPN’s research on the exposed AI supply chain, which is worth reading in full if you run any of this software.
| Class | Notable products | Endpoints | Behind auth |
|---|---|---|---|
| Model servers | Open WebUI 18,529, Ollama 6,935, vLLM 4,880, LocalAI 150 | 30,626 | 733 |
| Agent builders and workflow tools | Flowise 1,341, RAGFlow 891, Dify 792, ComfyUI 788, n8n 675, Langflow 250 | 5,223 | 8 |
| Vector stores | Milvus 914, Weaviate 6 | 920 | 0 |
| Total | 36,769 | 741 (2.02%) |
The authentication column is where the story is. 729 of the 741 authenticated endpoints are Ollama instances. Strip those out and twelve endpoints in the entire sample of 36,769 asked for a credential. Open WebUI, with 18,529 endpoints, returned exactly one. Flowise returned none across 1,341 instances.
Why 6,935 open Ollama servers matter
Ollama has the best authentication rate in the sample and is still the largest confirmed pool of anonymous access. Those 6,935 hosts returned the API response to an unauthenticated request, which is direct proof of reachability rather than an inference from a banner. Anyone who finds one can enumerate the models loaded on it and generate text on the owner’s GPU, at the owner’s electricity cost. The practice has a name, LLMjacking, and a market: stolen inference capacity gets resold.
The number is also a good illustration of why this count is conservative. In January 2026, researchers put the exposed Ollama population at roughly 175,000 hosts across 130 countries, a figure covered at the time by The Hacker News and SecurityWeek. That is about twenty-five times what this index surfaces for the same software. Different scanners see different slices of the internet, and no single index sees all of it.
Agent builders are credential vaults, not chatbots
The 5,223 exposed agent builders are the most serious part of the dataset, and the eight authenticated instances among them are the reason. Flowise, n8n, Dify and Langflow exist to connect a model to everything else a business runs. They store API keys, database credentials and webhook secrets by design, because that is the job. As the Mysterium researchers put it, an exposed agent builder is “an exposed credential vault with the company’s business logic attached.”
Two recent events show what that means in practice. In August 2026, researchers at GitGuardian found 321 live n8n instances that accepted API tokens harvested from public GitHub commits, giving access to workflows, execution data and in some configurations the raw credential values. No vulnerability was involved: the tokens were simply committed to public repositories and still valid.
Flowise has a live vulnerability to go with its zero authenticated instances. CVE-2026-40933 is a critical remote code execution flaw rated CVSS 9.9, affecting Flowise and flowise-components at version 3.0.13 and below, patched in 3.1.0. The bug is an unsafe deserialisation in the MCP adapter: an attacker who can reach the configuration canvas can register a custom stdio MCP server with a safe-listed command such as npx, then smuggle execution flags past the command-injection validator. Exploit code is public. Ransomnews has previously mapped how MCP becomes an attack chain, and this is that chain with the front door removed.
// Free tool
How does your own site score?
Run the same forty passive checks against your own domain — TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
The advisory classes the flaw as authenticated. In a deployment with no authentication in front of it, that distinction does not survive contact with the internet.
Why the real number is larger
The researchers are explicit about the limits of their own count, which is the main reason to trust it. Three gaps are worth naming.
- Vector stores are badly undercounted. The 920 figure captures web-UI exposures only. Native database ports were not in scope, and vector stores are where the embedded content actually lives, which makes them the most sensitive class in the set and the worst measured.
- The index is one view of the internet. The Ollama comparison above puts the scale of that gap at roughly twenty-five to one for at least one product.
- Geography is incomplete. Rate limits meant only 4,136 of the port-11434 responses, 18.8%, could be confirmed to a country. No national breakdown should be read off this dataset.
The research also notes 22,024 further responses on Ollama’s default port 11434 beyond the fingerprinted set, which is a reasonable indication that the true model-server population is considerably wider than the confirmed count.
What defenders should do now
None of the remediation here is novel, which is rather the point. This is a deployment-hygiene problem wearing an AI costume.
- Bind to localhost. Most of these services default to 127.0.0.1 and are deliberately changed to 0.0.0.0 during setup, often by following a tutorial. Check what your services are actually listening on.
- Put a reverse proxy in front of anything that must be reachable, with authentication enforced at the proxy rather than hoped for in the application.
- Treat agent builders as secrets infrastructure. They hold the same class of material as a password manager and deserve the same controls: network isolation, credential rotation, and audit.
- Rotate any token that has ever touched a public repository, and scan your own history rather than assuming it is clean.
- Patch Flowise to 3.1.0 or later if you run it anywhere, exposed or not.
- Scan your own estate with the published fingerprints. The fastest way to find out whether you are in this dataset is to look.
The wider pattern is familiar to anyone who has watched shadow AI spread inside organisations. Self-hosted AI gets stood up quickly, by people solving an immediate problem, outside the process that would normally put a service behind a gateway. The 2.02% figure is what that looks like measured across a whole category, and the trade-offs involved are the ones we covered in local AI versus cloud AI.
Frequently asked questions
How many AI servers are exposed on the internet?
Mysterium VPN fingerprinted 36,769 self-hosted AI endpoints reachable from the public internet in late August 2026, across model servers, agent builders and vector stores. The researchers describe this as a floor, because independent scans of a single product have found far larger populations.
What is LLMjacking?
LLMjacking is the unauthorised use of someone else’s AI inference capacity, typically by finding an exposed model server and generating text on the owner’s hardware. The victim pays in GPU time and electricity, and stolen capacity is resold.
Is Ollama safe to expose to the internet?
No. Ollama binds to localhost by default and does not ship with authentication, so an instance changed to listen on 0.0.0.0 will answer anonymous API requests. Put it behind a reverse proxy that enforces credentials, or keep it on the loopback interface.
What is CVE-2026-40933?
CVE-2026-40933 is a critical remote code execution vulnerability in Flowise, rated CVSS 9.9, affecting versions up to and including 3.0.13 and fixed in 3.1.0. It abuses unsafe handling of custom MCP stdio server configuration to run arbitrary operating-system commands.
Why are agent builders riskier than exposed chatbots?
Agent builders such as Flowise and n8n store API keys, database credentials and webhook secrets so they can connect a model to other systems. An exposed instance therefore hands over working credentials to third-party services, not just a conversation interface.
How do I check whether my AI infrastructure is exposed?
Check what interface each service is bound to, then scan your own external address ranges for the relevant ports and response fingerprints. Mysterium VPN published the fingerprints it used, which makes the check reproducible against your own estate.
Sources and further reading
- Mysterium VPN: The Exposed AI Supply Chain (research, 10 September 2026)
- GitHub Advisory Database: CVE-2026-40933, Flowise authenticated RCE via MCP adapters
- SecurityWeek: exploit code published for critical Flowise RCE vulnerability
- The Hacker News: leaked n8n API tokens exposed live instances to credential theft
- The Hacker News: researchers find 175,000 publicly exposed Ollama AI servers
- Related reading on Ransomnews: the MCP attack surface mapped, building a secure MCP server, and prompt injection in the wild.
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.