The AI boom keeps producing new models and chatbots. It is also producing a lot of unlocked doors.
The amount of AI-related infrastructure exposed to the public internet rose 63% in nine months, according to Censys data shared first with Axios. Companies are deploying AI tooling faster than they are securing it.
The numbers behind the jump
Censys is an internet intelligence and attack surface management firm. Its job is to map what is visible from the open internet, and lately that view has filled up with AI software.
The firm counted more than 294,000 distinct public IP addresses exposing 43 different AI and LLM tools. In October 2025, the same count was approximately 183,000.
Censys singled out two fast-growing platforms where growth and risk overlap. The first is Langflow, which grew 169% over the period.
Langflow has been tied to 18 Common Vulnerabilities and Exposures, or CVEs, reported from 2024 to 2026. Of those 18 flaws, 14 carry a CVSS score above 8.0. Four of Langflow’s flaws appear in the CISA Known Exploited Vulnerabilities catalog.
The second platform is LiteLLM, which grew 97%. LiteLLM is affected by an actively exploited pre-authentication SQL injection vulnerability, tracked as CVE-2026-42208.
A report long in the making
The figures come from Censys’s 2026 State of the Internet Report, published around October 8, 2026. Preview findings surfaced in July 2026 on the Censys blog. Outlets including eSecurity Planet and Cybersecurity Dive covered them at the time. The full report followed in October.
AI is not the report’s only subject. It also examines exposures in industrial control systems and other threat infrastructure.
What this means for companies and the security market
The Langflow and LiteLLM figures show why rapid deployment matters. Growth of 169% and 97% means many new deployments went live in a short window while attackers were already working with known, high-severity bugs in the same software.
When a tool has 14 flaws rated above 8.0 on CVSS, the KEV catalog gives defenders a shortcut: start with the bugs attackers are already using.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.