The Exposed AI Supply Chain — Mysterium VPN Research

Key Takeaways

• 36,769 self-hosted AI endpoints across model servers, agent builders, and vector stores are reachable and identify themselves in a single scanning index.
• Only 2.02% return an HTTP authentication challenge; for the overwhelming majority, there’s no network-layer gate whatsoever.
• Open WebUI: 18,529 reachable, 1 behind a gate: The most widely deployed local-LLM front-end has, as a population, no perimeter.
• 6,935 Ollama servers answer their API root to an anonymous request — proven by the response body, not inferred.
• The agent builders are the dangerous class: 5,223 endpoints across Flowise, n8n, ComfyUI, Dify, RAGFlow, Langflow and Pipelines — tools designed to store credentials. Flowise: 1,341 reachable, zero auth challenges.
• This is a floor, not a ceiling: Independent scanners have reported Ollama populations near 175,000. Two major vector databases aren’t scanned by this source at all.

The Census

Separately: 22,024 responses on port 11434, Ollama's default — excluded from the total as a weaker signal than a service banner. A dash means the query did not resolve within the source's rate limits; we left those blank rather than guess.

Model servers

Scale 0–18,529.

Agent builders and workflow tools

This is the class that stores credentials by design. Scale 0–1,341.

Finding 1: There’s No Perimeter

Across the whole census, 741 endpoints out of 36,769 returned an HTTP authentication challenge — 2.02%. For twelve of the seventeen products, we have a confirmed challenge count; for five, the query did not resolve within the source's rate limits.

Share of reachable endpoints behind an HTTP authentication gate

Scale 0–10.5%. Only Ollama registers at this scale — every other product sits at or near zero, which is the finding.

Ollama is the exception that proves the pattern rather than breaking it: 729 of its 6,935 banner-serving hosts return a challenge — the highest rate in the census, and still nine in ten with nothing in front of them.

The honest reading isn’t "every one of these is wide open to anyone." It’s that this entire category of software is being deployed without a network perimeter — no reverse proxy requiring credentials, no VPN, no gateway, no IP allowlist. 

Everything rests on the application's own login, if it has one, and on that application never having a bug. For a class of software this young, shipping this fast, that is a large bet.

Finding 2: 6,935 Model Servers Answer to Anyone

For Ollama, we can make the strong claim, because the fingerprint is the proof.

An Ollama server's root path returns the plain-text string "Ollama is running" to any anonymous request. It is not a login page and not a marketing page — it is the API telling an unauthenticated caller that it is alive and listening. Ollama ships with no authentication of its own; the documented protection is not to expose it.

6,935 hosts returned that string. 6,046 of them with an explicit HTTP 200.

An Ollama instance reachable this way exposes an API that can list every model on the machine and — for anyone willing to go further than we did — generate text on the owner's hardware at the owner's expense. The security community calls that LLMjacking: someone else's inference running on your GPU and your electricity bill. We counted the doors. We didn’t open them.

Finding 3: The Agent Builders Should Worry a Business

Of the census, 5,223 endpoints are agent builders and workflow tools. These deserve separate treatment because of what they are for.

A model server holds a model. An agent builder holds the credentials required to reach everything else: the OpenAI key, the database login, the Slack token, the webhook secret, the CRM password. Storing those is the product's core function — that’s how a workflow written in n8n or Flowise reaches the systems it automates. An exposed agent builder isn’t an exposed chatbot. It’s an exposed credential vault with the company's business logic attached.

The exposure is not hypothetical, and the wider record already shows what follows from it. In August 2026, researchers reported 321 live n8n instances that accepted API tokens harvested from public GitHub commits — no vulnerability required, just a leaked token and a reachable host. 

GitGuardian has documented how a leaked n8n key can expose the instance's encryption key, the thing protecting every stored credential. Flowise has a live remote-code-execution CVE, CVE-2026-40933.

Set that against our counts: Flowise, 1,341 reachable with zero authentication challenges. n8n, 675 reachable with six.

Finding 4: What We Could Not See, and Why It Matters Most

The weakest part of this census is the part that would be most alarming if we could measure it properly.

Vector stores returned 920 endpoints — and that number is close to meaningless. Qdrant's native port (6333) and Milvus's (19530) both return zero results in this index, not because nothing is listening on them but because this source does not scan them. 

Our vector-store figure consists almost entirely of Milvus's Attu web console (914) and a handful of Weaviate instances (6). It measures which vector databases happen to have a web UI — not how many are exposed.

This matters because vector stores are where the content lives. A model server exposes capability. An agent builder exposes credentials. A vector store exposes the embedded contents of whatever corpus was indexed into it — internal documents, support tickets, customer records, the private knowledge base someone built a RAG system on top of.

We are reporting a floor of 920 for the one class where the true number is likely highest. Nobody should read this study as evidence that self-hosted vector databases are well protected. We simply couldn't see them.

The same caution applies across the board. Independent scanners have put the exposed Ollama population near 175,000 hosts across 130 countries — roughly twenty-five times what this index sees. Every number in this study is a lower bound produced by one vantage point.

We had intended to publish a country breakdown. The source's rate limits defeated us: several of the largest countries failed to resolve, and a ranking missing the United States and China is worse than no ranking. The one geographic figure we can stand behind is that 4,136 of the 22,024 port-11434 responses (18.8%) are in the United States.

Summary

Over the last two years, an enormous amount of AI infrastructure moved out of the cloud providers and onto machines that individuals and companies run themselves. Model servers, chat front-ends, "AI agent" builders, vector databases. The appeal is obvious: your prompts and your documents stay on your hardware instead of somebody else's. That only holds if nobody else can reach your hardware. 

We ran a census of that stack across the public internet, using a third-party scanning index rather than touching a single one of these machines ourselves. 36,769 endpoints answered and identified themselves. Of those, only 741 (2%) returned any HTTP authentication challenge at all.

Endpoints reachable and self-identifying, by class

Scale 0–30,626.

Vector stores are badly undercounted — see Finding 4. 

Open WebUI, the most popular self-hosted chat interface for local models, has 18,529 instances reachable on the public internet. Exactly one sits behind an HTTP authentication gate.

A web application answering on the open internet is not necessarily an open application — it may be serving a login screen. What our data establishes is narrower and still serious: almost none of this infrastructure is protected at the network or HTTP layer. There’s no proxy, no basic auth, no gateway. Whatever protection exists is inside the application — the layer where CVEs, default credentials, and misconfigurations live.

For one product, we can go further. Ollama's root endpoint answers anonymous requests with the string "Ollama is running" — a response that only exists when the API is reachable without credentials. 6,935 servers returned it.

What Should Change

None of this is a vulnerability report, and it would be unfair to file it as one. Ollama, Open WebUI, Flowise, and n8n aren’t broken. 

They’re doing what they were designed to do: run on a machine and serve a local user. The failure is in deployment — thousands of people binding to 0.0.0.0 on a cloud box, in a hurry, and never putting anything in front of it. That makes it fixable, in a way a product vulnerability would not be:

• Bind to localhost: The default for a personal AI stack should be 127.0.0.1, reached over an SSH tunnel or a private network. If nothing needs to reach it from the internet, nothing should be able to.
• Put a gate in front of it: A reverse proxy requiring authentication turns a 200 into a 401. On the evidence of this census, 98% of deployments have not done this.
• Treat an agent builder as a secrets store: If it holds your API keys, it deserves the controls you would give a password manager, not a hobby project.
• Check what you already run: The fingerprints in the census table work in any internet scanning index. Anyone can look for their own organisation's exposure using the same method we did.

Methodology

This study is a count, and the discipline that makes it publishable is what we refused to do. 

We used the public query interface of Netlas, an internet-wide scanning index, and asked how many indexed responses match a given fingerprint. Every figure here is the answer to a counting question put to a third-party database that had already scanned the internet.

What we did not do

We never contacted a single exposed host. We did not retrieve documents, model lists, prompts, chat logs, or workflow definitions. We did not read or record a credential. We did not run inference on anyone's GPU. We did not exploit, or attempt to confirm, any vulnerability. We do not publish IP addresses, hostnames, or anything identifying an individual deployment.

What HTTP status can and cannot tell you

We recorded, for each fingerprint, how many responses carried HTTP 200 and how many carried 401 or 403. A 401/403 is strong evidence of an authentication gate. A 200 is not evidence of its absence — a login page returns 200. We therefore report the authentication-challenge rate as our headline protection metric, and decline to convert 200s into a claim of "unauthenticated" — except for Ollama, where the fingerprint is itself the API's anonymous response.

Counting unit: The index counts indexed responses — host and port observations. A machine exposing two services appears twice. We report the Ollama port-11434 population (22,024) separately from the confirmed-banner population (6,935), and exclude the port figure from all totals, because a port number is a weaker claim than a service that identified itself.

Sources

• Netlas.io public response-count API — our own queries, 30–31 August 2026.
• The Hacker News, Researchers Find 175,000 Publicly Exposed Ollama AI Servers (January 2026).
• LeakIX, 12,000 Ollama Instances Exposed (February 2026).
• The Hacker News, Leaked n8n API Tokens Exposed Live Instances to Credential Theft (August 2026).
• GitGuardian, n8n Security: How Leaked API Keys Expose Your Encryption Key.
• Gridinsoft, Flowise Chatflow RCE — CVE-2026-40933.