Censys released its 2026 State of the Internet report last week. The headline, as Axios reported it: exposed AI infrastructure grew 63% in nine months. Censys counted nearly 268,000 internet-facing systems running 44 different AI products as of July, up from about 164,000 in October 2025.
The most exposed product on that list wasn't a chatbot or a model server. It was n8n, the workflow automation tool. Censys found nearly 114,000 n8n hosts on the open internet, and roughly 77,000 were running versions affected by at least one recently disclosed critical vulnerability. On its report page, Censys puts it another way: 76% of n8n hosts with a known version are affected by a critical vulnerability.
Censys is careful to say that exposure isn't the same as exploitable. Some of those boxes may have other protections in front of them. Still, 77,000 is a lot of front doors.
Why n8n is a better target than your website
Think about what an automation tool does. It connects to your CRM, your email, your database, your Slack, your payment processor, and your AI provider. To do that, it stores credentials for all of them.
Emily Austin, a principal researcher at Censys and co-author of the report, told Axios: "these [tools] talk to some really sensitive systems."
Break into a marketing site and you get a marketing site. Break into the automation server and you get the keys to everything it talks to. It's the same reason attackers love password managers and CI servers. One box, many secrets.
And these tools usually get set up fast, by whoever needed the workflow, often on a cheap VPS with the editor open to the world so it's easy to reach. Then nobody thinks about it again.
The bugs in question
n8n has had two maximum-severity bugs in the last year:
- CVE-2026-21858, nicknamed Ni8mare. CVSS 10, per Censys's advisory. No login needed. An attacker can run system commands and take over the host. It affects every version below 1.121.0.
- CVE-2025-68613. Also CVSS 10. It needs an authenticated user, who can then run code through workflow expressions. CISA added it to the Known Exploited Vulnerabilities catalog in March, which means it's being used in real attacks. Fixed in 1.120.4, 1.121.1, and 1.122.0.
Both have had patches out for months. The 77,000 number is mostly servers that just never got updated.
It's not just n8n
Censys also counted more than 54,000 exposed control panels for OpenClaw, the open-source AI agent. In January, it had counted about 21,600. The pattern is the same: a tool that holds API keys and can take actions, set up quickly, and left reachable from anywhere.
The same goes for self-hosted model servers, LLM proxies, and agent dashboards. If it holds keys and has a web UI, assume someone is scanning for it.
What to do
- Find out if you have one. Ask around. Marketing ops, sales ops, and the one engineer who automates everything are the usual suspects.
- Update it today. If it's below 1.121.0, it is exposed to an unauthenticated takeover bug.
- Take the editor off the public internet. Put it behind a VPN, SSO, or an access proxy like Cloudflare Access. Webhooks that need to be public can stay public. The editor doesn't need to be.
- If it was exposed and out of date, rotate the credentials. Every API key and OAuth token stored in it. You can't prove nobody got in, so assume someone did.
- Limit who can create workflows. CVE-2025-68613 needs an authenticated user. Fewer accounts with edit rights means fewer ways in.
The bigger point
When people think about their attack surface, they think about their app. But the tools you use to run the business are part of it too, and they often have more access than the app does.
The free scan will tell you what's visible on a domain. A pen test can include the side tools too, if you tell us they exist. That's usually where the interesting findings are.