Overview
- Censys's October 2026 State of the Internet report found internet-facing AI systems rose about 63% over nine months, reaching nearly 268,000 hosts.
- The most widely exposed product was n8n with roughly 114,000 internet-facing deployments and about three quarters of identifiable instances running versions in ranges tied to recent critical vulnerabilities.
- Censys highlighted fast-growing platforms such as Langflow and LiteLLM, and said LiteLLM is affected by an actively exploited pre-authentication SQL injection tracked as CVE-2026-42208.
- Researchers warned that many exposed orchestration and connector tools link AI to corporate systems, so a compromise could give access to credentials, databases, or internal apps even if exposure alone does not prove exploitation.
- Defenders are urged to build continuous internet visibility, fix known exploited CVEs first, treat AI orchestration layers as high-priority assets, and focus on inventory-driven patching because quick weaponization shortens response windows.