Exposed AI Endpoints Pose Major Security Risks Across Industries
36,769 self-hosted AI systems found publicly accessible with minimal authentication
1The Scale of Exposure
A comprehensive study by Mysterium VPN identified 36,769 exposed AI endpoints across model servers, agent-building platforms, and vector stores. Shockingly, only 2% of these systems had any HTTP authentication gate. The most vulnerable was Open WebUI with 18,529 reachable instances, where only one had proper authentication. This widespread exposure creates massive security risks as these systems often contain sensitive business data and operational workflows.
2Local Hosting Paradox
While organizations choose self-hosted AI solutions for greater control, many improperly configure their infrastructure. The study found 6,935 exposed Ollama servers returning 'Ollama is running' without credentials. These systems not only reveal installed models but allow unauthorized text generation using the owner's hardware. This creates resource abuse scenarios where attackers consume GPU time while owners foot the electricity bill - a phenomenon security experts call 'LLMjacking'.
3Workflow Platform Risks
Beyond model servers, researchers identified 5,223 exposed agent builders like Flowise and n8n that connect AI to company infrastructure. These platforms often store API keys, database credentials, and Slack tokens. For example, all 1,341 reachable Flowise instances lacked authentication. A critical vulnerability (CVE-2026-40933) in Flowise could allow command execution, though patched in version 3.1.0. Such exposures turn workflow platforms into potential entry points for broader system compromise.
4Credential Exposure Pathways
Attackers don't always need software vulnerabilities. GitGuardian found 4,576 exposed n8n API tokens in GitHub commits, with 321 accepting leaked tokens during testing. These credentials provide direct access to workflows without exploiting flaws. The problem extends to vector databases too, with 920 exposed endpoints found - mostly Attu consoles for Milvus containing sensitive information used by AI systems to generate responses.
5Verification Methodology
Researchers used Netlas internet scanning index and specific fingerprint matching to identify exposures. They distinguished between HTTP 200 responses (which could include login pages) and definitive 401/403 authentication challenges. Importantly, they didn't attempt access or data retrieval, only counting identifiable systems. This conservative approach suggests actual exposures may be higher than the 36,769 documented endpoints.
6Historical Context
This isn't an isolated issue. A January 2024 SentinelOne and Censys study found approximately 175,000 exposed Ollama hosts across 130 countries. Nearly half supported tool-calling capabilities that could execute code or access external systems. The disparity with Mysterium's numbers comes from different scanning methodologies, but both studies reveal systemic security gaps in AI deployment practices.
7Security Implications
Exposed AI infrastructure creates multiple attack vectors: credential theft via workflow platforms, model hijacking through unsecured APIs, and data exfiltration from vector stores. Unlike traditional systems, AI endpoints often connect to multiple business systems, amplifying potential damage. The 'assumed security' of local hosting evaporates when systems are improperly placed on public networks without additional protection layers.
8Actionable Recommendations
Organizations must implement network-level authentication for all AI infrastructure, regularly audit exposed endpoints, and monitor for credential leaks. Workflow platforms should never be internet-facing without robust security controls. As AI systems become operational backbones rather than experimental tools, their security posture must match their business criticality to prevent becoming the weakest link in organizational defenses.