The report finds exposed AI infrastructure reached nearly 268,000 internet-facing systems, while industrial control system exposures and outdated software remain ongoing concerns.
Censys has released its fifth annual State of the Internet Report, finding that exposed AI infrastructure grew 63% in nine months. The report also identified around 134,000 internet-exposed hosts running industrial control systems (ICS), with approximately 70% found on consumer and mobile networks.
The findings highlight the growth of exposed AI systems, persistent ICS exposure and uneven software updates, alongside geographic differences in observed threat infrastructure.
Key Findings from the State of the Internet Report
- Exposed AI infrastructure grew 63% in nine months: Nearly 268,000 internet-facing systems were identified. These include chatbots and tools connecting AI systems to data, applications and user accounts.
- n8n is the most commonly exposed AI product: Censys identified nearly 114,000 exposed n8n hosts, followed by approximately 54,000 running OpenClaw, a personal AI agent assistant. The United States (62,687), China (42,511) and Germany (31,222) accounted for just over half of the observed exposed AI infrastructure.
- North America accounts for the largest share of exposed industrial control systems (ICS): The region represented approximately 38% of observed global ICS exposures, followed by Europe at 32% and Asia at 25%. Censys also found that around 70% of hosts running ICS devices and services globally were exposed on consumer and mobile networks.
- China and the United States host different types of observed threat infrastructure: China accounted for 36.6% of malicious host-level infrastructure, including command-and-control servers and remote-access tools, compared with 16.8% in the United States. However, the United States accounted for 45.5% of observed web-based threats, such as phishing and deceptive pages, compared with 20.9% in China.
- Older software versions remain in use: Across four products studied—Progress Telerik Report Server, Jenkins, Cleo MFT and Microsoft SharePoint Server—organisations adopted newer versions, but the oldest versions remained largely unchanged during the study period.
“The Internet is constantly changing, and understanding how it changes is critical to modern cybersecurity,” said Zakir Durumeric, Co-Founder and CEO of Censys. “New technologies such as AI introduce new layers of infrastructure. Identifying and continuously monitoring Internet-facing systems is essential to realizing AI’s value without introducing unmanaged risk.”
Source: Censys 2026 State of the Internet Report.
Disclaimer: This article is based on Censys’ State of the Internet Report and has been edited for length and readability. Readers are advised to consult the full report for detailed findings and methodology.
