Over One Million AI Services Exposed Due to Missing Auth.

According to The Hacker News, a scan of certificate transparency logs pulled just over 2 million hosts, exposing about 1 million AI services. The assessment found that many of these AI infrastructures were deployed with no authentication by default, meaning real user data and company tooling could be exposed to anyone. The researchers highlighted numerous striking examples, including freely accessible chatbots and credential lists, with flows and prompts left open to abuse and potential data exfiltration.

They also identified more than 90 exposed instances across sectors such as government, marketing, and finance, and noted that Ollama APIs connected to hosted models were exposed; out of 5,200+ servers queried, 31% answered, with 518 wrapping well-known frontier models. The report argues that insecure by design patterns, weak access controls, and rapid AI adoption are driving a larger blast radius, underscoring the urgency for improved authentication, deployment defaults, and credential handling.