Nine months ago, Censys could find 164,088 AI-related systems answering the public internet. In July it found 267,915. That is the headline of the company's fifth annual State of the Internet Report, released on October 14, and the finding that deserves attention is not the size of the number but its speed. AI software is being put online faster than almost anything else Censys tracks, and much of it holds the keys to other systems.

Growth at nearly 6 percent a month

Exposed AI infrastructure grew 63 percent between October 2025 and July 2026, according to Help Net Security's summary of the report. That is 103,827 additional systems, roughly 380 a day. Compounded, it is about 5.6 percent growth every month.

Compare that with the report's industrial control system (ICS) findings. Censys counted about 134,000 exposed ICS hosts in early 2026, up from about 129,000 in 2024, a rise of roughly 4 percent over two and a half years. My arithmetic puts that at about 0.13 percent a month, which makes AI exposure grow roughly 40 times faster. The two periods differ in length, so the ratio is approximate. The direction is not in doubt: patching and inventory habits built for slow-moving software are being applied to the fastest-moving category.

One workflow tool carries much of the risk

The most widely exposed product is n8n, a workflow automation platform that connects AI agents to other applications. Censys found 113,926 n8n hosts, about 43 percent of all the exposed AI systems it counted. Among the n8n servers that report a version, 76.1 percent run a release inside the affected range of at least one vulnerability scored 9.0 or higher, Help Net Security reports. Axios put the number at roughly 77,000 servers, which by my arithmetic implies about 101,000 report a version.

The danger is what these servers hold. Help Net Security notes that they store credentials for the services their workflows connect to. A compromised n8n host is therefore a way into everything it was connected to, not just a broken automation.

OpenClaw, a self-hosted AI agent, shows how fast a tool can spread. Its first release with a control panel shipped on January 5, 2026. Six days later Censys saw two exposed panels. By April 7 there were 85,478, an average of about 930 new panels a day.

Three countries hold half of it

Exposure is global. The United States hosts 62,687 exposed AI systems, China 42,511 and Germany 31,222, together just over half of the total, according to Censys. Those three add up to 136,420, or about 51 percent. Germany's third place is the detail worth noting, because it shows exposure is not only a US and Chinese problem.

The pattern is not new for this class of software. Censys's earlier study of Model Context Protocol servers found 12,520 internet-accessible services across 56 countries just four days after it began scanning in April, and more than 21,000 by early May. It also noted that the protocol does not require authentication by default.

Why a vulnerable server matters beyond the box

These tools reach into sensitive places. Emily Austin, a principal researcher at Censys and co-author of the report, told Axios they talk to some very sensitive systems, and Censys CEO Zakir Durumeric said companies were already struggling to track their existing software before employees began building their own AI applications.

The same pattern shows up in the consumer world. Anthropic's red team has warned that small models are months from copying themselves onto ordinary devices such as smart fridges, and an internet already holding more than a quarter of a million reachable AI systems is more welcoming ground for software that moves on its own. That is my inference, not a Censys finding. On desktops, Apple recently tightened Mac file access after AI agents read more than users expected. And the FTC's recent probe of OpenAI and Anthropic over rogue agent risks targets model vendors, while n8n and OpenClaw are self-hosted tools run by their own users, outside any vendor's reach.

What the count cannot tell us

An exposed server is not a breached one. Censys measures what is reachable and what version it runs, not whether anyone has attacked it, and some deployments may be public on purpose. The count is also a July snapshot, and Censys sells internet intelligence products, which gives it a reason to emphasize the scale of the problem.

Even so, the combination is hard to dismiss: tens of thousands of servers on flawed versions, each holding credentials, in a category growing far faster than the others Censys tracks. The practical test will not be the next report's total. It will be whether the share of n8n hosts on affected versions, 76.1 percent today, falls once the maintainers and the people running them have had a full year to notice.