RESEARCHERS from Mysterium VPN warn that a substantial portion of self-hosted AI infrastructure is openly reachable on the internet. In a scan of model servers, agent-building platforms and vector stores, they found 36,769 exposed AI endpoints that could be identified via public internet indexing. Only about 2.02% of these actually prompted an HTTP authentication challenge, meaning the vast majority lacked a network-layer gate.
Open WebUI accounted for the largest share (18,529), with vLLM, LocalAI and llama[.]cpp also visible but showing few authentication prompts. The study emphasises that an internet-facing endpoint does not automatically imply a breach, but it does elevate the risk of abuse, particularly when exposed systems reveal installed models or credentials.
Beyond the model endpoints, the researchers highlighted security risks at the workflow and data layers. They documented 5,223 exposed agent builders and workflow platforms (Flowise, n8n, ComfyUI, Dify, RAGFlow, Langflow, Open WebUI Pipelines) where credentials and API keys can reside in live deployments. In a notable CVE example, Flowise shows CVE-2026-40933, a critical flaw allowing command execution via the MCP adapter, fixed in version 3.1.0.
The study also notes 4,576 exposed n8n API tokens and 321 reachable instances that accepted leaked tokens, enabling potential access to workflows and connected systems. Additionally, about 920 vector-store endpoints were found, dominated by Milvus’ Attu consoles, though the scan could only capture a floor estimate rather than the full picture.
The report stresses that the lack of evidence of compromise does not imply safety, and that many organisations’ AI stacks—if exposed—should be treated as internet-facing systems requiring authentication and proper fronting controls.