Ethical Hacking News
A recent study has revealed that the AI supply chain is vulnerable to security threats, with many AI endpoints exposed on the open internet. Researchers found that 36,769 self-hosted AI endpoints were reachable and identifiable through a public internet scanning index, but only 2.02% had an HTTP authentication gate. The study highlights the need for better security measures to protect AI infrastructure, particularly agent builders and workflow platforms that often connect AI models to the rest of a company's infrastructure. The researchers' findings emphasize the importance of proper deployment and security protocols to prevent AI-related security threats.
The AI supply chain has many exposed endpoints on the open internet, with 36,769 self-hosted AI endpoints reachable and identifiable. Only 2.02% of these endpoints have an HTTP authentication gate, leaving the majority vulnerable to attacks. 5,223 exposed agent builders and workflow platforms pose a significant risk due to their connection to the company's infrastructure. The largest number of endpoints came from Open WebUI, with only one instance returning an HTTP authentication challenge. The study found 920 vector-store endpoints, with most being exposed, but the true number is likely higher due to limitations in the scanning process. The risk of AI security breaches extends beyond the workflow layer, with vector databases and model servers potentially exposing sensitive information. The study emphasizes the importance of deploying AI infrastructure securely, including using authentication and network controls to protect exposed endpoints. The research provides a way for defenders to check for exposed deployments, making it a valuable tool for AI security.
The AI supply chain has been found to be vulnerable to security threats, with many AI endpoints exposed on the open internet. Researchers from Mysterium VPN recently conducted a study to assess the security of AI endpoints, and the findings are concerning.
The study revealed that 36,769 self-hosted AI endpoints were reachable and identifiable through a public internet scanning index. However, only 2.02% of these endpoints had an HTTP authentication gate, leaving the vast majority of them exposed to potential attacks. The most widely deployed local-LLM front-end, Open WebUI, had 18,529 reachable instances, but only one returned an HTTP authentication challenge.
The researchers used HTTP 401 and 403 responses as evidence of an authentication gate and made a stronger claim only where the application fingerprint itself proved anonymous access. They did not connect to the exposed systems, retrieve data, run models, read credentials, or exploit vulnerabilities. Instead, they queried Netlas, a third-party internet scanning index, and counted responses that matched specific fingerprints.
The study also identified 5,223 exposed agent builders and workflow platforms, including Flowise, n8n, ComfyUI, Dify, RAGFlow, Langflow, and Open WebUI Pipelines. These systems deserve more attention because they don't simply host an AI model. They often connect that model to the rest of the company's infrastructure, and their exposure can pose a significant risk.
The researchers found that the largest number of endpoints came from Open WebUI, with 18,529 reachable instances. However, only one returned an HTTP authentication challenge. vLLM accounted for another 4,880 endpoints, with just three showing an authentication challenge. LocalAI had 150 and llama.cpp had 69, with neither showing a challenge.
Ollama produced a particularly important finding because the researchers could verify anonymous access from the service response itself. An exposed Ollama server returns the text "Ollama is running" from its root endpoint without requiring credentials, and 6,935 hosts returned that fingerprint. Of those, 6,046 returned an explicit HTTP 200 response.
This isn't just about seeing a chatbot from the internet. An exposed Ollama API can reveal the models installed on the machine and can be used to generate text using the owner's hardware. That creates a straightforward resource-abuse problem: someone else gets the GPU time and the owner gets the electricity bill.
The security community calls this LLMjacking, but the underlying problem is familiar. The AI label doesn't make an exposed API magically safer. There is also evidence that this isn't a small or isolated deployment mistake. A separate SentinelOne and Censys study published in January identified around 175,000 publicly exposed Ollama hosts across 130 countries. Almost half of those systems supported tool-calling capabilities that could execute code, access APIs, or interact with external systems.
The researchers found that the risk doesn't stop at the workflow layer. Vector databases can contain the actual information that an AI system uses to answer questions. Mysterium identified 920 vector-store endpoints, almost all of them exposed Attu consoles for Milvus. However, the researchers are clear that this number tells us very little about the real exposure. Qdrant's native port and Milvus's native database port weren't scanned by the source, so a database could be publicly reachable without appearing in the census.
The study also found that the vector-store figure is a floor, not a ceiling. A model server exposes computing capability, an agent builder can expose credentials, and a vector store can expose the information that an organization has loaded into its AI system: internal documents, support tickets, customer records, or private knowledge bases.
"We are reporting a floor of 920 for the one class where the true number is likely highest. Nobody should read this study as evidence that self-hosted vector databases are well protected," continues the report. "We simply couldn't see them."
The same caution applies to geography. Mysterium wanted to publish a country breakdown, but rate limits prevented reliable results for several major countries. Rather than publish a misleading ranking, the researchers dropped it. The one figure they could support was that 4,136 of the 22,024 responses observed on port 11434, or 18.8%, came from the United States.
The underlying problem, however, is difficult to dismiss. Over the past two years, organizations and individual developers have moved more AI infrastructure away from managed cloud services and onto their own machines. That can improve privacy and control, but it also transfers much of the security responsibility to whoever deploys the system.
A local AI stack should therefore be treated like any other internet-facing service. If the model doesn't need to be reachable from the internet, bind it to localhost or a private network. If remote access is necessary, put authentication and network controls in front of it, rather than relying entirely on the application's own login system.
The same logic applies to agent builders. If an n8n or Flowise installation holds API keys and credentials that can reach production systems, it deserves the same level of protection you'd give a password manager. Calling it an "AI tool" doesn't reduce the value of what it stores.
There is also a basic operational question that many organizations should answer now: what AI infrastructure is already exposed?
Mysterium's fingerprints can be used with internet-scanning services to check for exposed deployments. That makes the research useful not because it proves that 36,769 systems are compromised, but because it gives defenders a way to look for their own systems before someone else does.
The AI security problem isn't always a sophisticated model attack or a novel prompt-injection technique. Sometimes it's a developer binding a service to 0.0.0.0, putting it on a cloud server, and forgetting that the internet can see it.
"None of this is a vulnerability report, and it would be unfair to file it as one. Ollama, Open WebUI, Flowise, and n8n aren't broken," concludes the report. "They're doing what they were designed to do: run on a machine and serve a local user. The failure is in deployment — thousands of people binding to 0.0.0.0 on a cloud box, in a hurry, and never putting anything in front of it."
Related Information:
https://www.ethicalhackingnews.com/articles/The-Exposed-AI-Supply-Chain-A-Security-Nightmare-ehn.shtml
https://securityaffairs.com/198898/ai/the-ai-supply-chain-has-a-security-problem-and-much-of-it-is-sitting-on-the-open-internet.html
Published: Fri Sep 11 13:58:11 2026 by llama3.2 3B Q4_K_M
