The AI boom is expanding not only the market for neural networks and chatbots, but also the infrastructure that connects models to corporate databases, email, and other services. According to data from research company Censys, which it shared with Axios, over nine months the number of internet-accessible systems related to AI grew by 63% — to nearly 268,000. Many of them have access to sensitive information and therefore could become a potential entry point for hackers.

Nearly 268,000 systems are accessible from the internet

According to Censys, in July 2026 researchers discovered about 268,000 internet-accessible systems using 44 different AI products. In October 2025, there were about 164,000 such systems.

This is not only about the models themselves. This infrastructure includes tools that allow AI applications to interact with databases, enterprise software, and other services. They help automate workflows, but at the same time expand the range of systems through which internal organizational resources could potentially be accessed.

According to Emily Austin, principal researcher at Censys and one of the report’s authors, the danger lies not so much in the individual tools themselves as in which sensitive systems they interact with.

Which AI tools are most often left exposed

Among the discovered solutions, n8n leads the list — a workflow automation platform that makes it possible to connect various applications and link AI agents to them. Censys identified nearly 114,000 internet-accessible installations of this product.

Around 77,000 of them were running software versions affected by at least one recently disclosed critical vulnerability. However, this does not mean that all of these installations can be successfully hacked: the study does not determine whether each specific system is vulnerable to a real-world attack.

Another more than 54,000 discovered systems were exposed OpenClaw control panels — an open-source AI agent that users can connect to personal accounts and other services.

Such connections make the tools more useful: the agent can work with data and perform tasks on behalf of the user. But if the system is configured insecurely, an attacker could potentially gain an additional path to those resources.

Why it is becoming harder for companies to control AI

Creating and deploying AI applications is becoming easier and easier. Employees can independently assemble automated systems, connect them to corporate services, and launch them without a full review by the IT department.

As a result, it is becoming increasingly difficult for companies to understand what software is actually running in their infrastructure, what permissions it has been granted, and how securely it is protected.

Censys CEO Zakir Durumeric notes that organizations had trouble keeping track of installed software even before the mass spread of AI. Now this problem has been compounded by applications that employees create themselves and grant access to internal data.

Potentially affected information includes email, financial documents, and corporate databases. If an AI tool has access to such resources, its security becomes part of the company’s overall defense.

Open access does not necessarily mean a successful breach

Censys found a large number of internet-accessible systems, but this alone does not prove that attackers can use them freely. A successful attack may require a specific vulnerability, insufficient access controls, or additional conditions.

Nevertheless, the study points to a growing attack surface — the total set of entry points into digital infrastructure available to malicious actors. The more tools are connected to corporate data and services, the more important it becomes to control their settings, updates, and permissions.

According to the researchers, companies should treat AI infrastructure just as seriously as any other software: keep track of all deployed systems, regularly install updates, check security settings, and restrict access to only the necessary privileges.

AI applications are becoming part of everyday corporate work, but the convenience of automation does not eliminate the basic requirements for data protection. The more actively organizations implement such solutions, the more important it is to understand where they operate, what they are connected to, and who can gain access to them.