A recent study has revealed a significant cybersecurity vulnerability within the self-hosted artificial intelligence (AI) ecosystem, identifying tens of thousands of exposed AI endpoints that lack basic authentication. Researchers from Mysterium VPN found 36,769 such endpoints, including model servers, agent-building platforms, and vector stores, all publicly accessible via internet scanning indexes. A striking 98% of these endpoints did not present an HTTP authentication challenge, indicating a widespread absence of network-layer security.
The findings highlight a critical gap in the security posture of organizations opting to run AI models locally, a strategy often chosen for greater control over data and infrastructure. However, this advantage is negated when the underlying infrastructure is directly exposed to the internet without proper safeguards.
Among the most prevalent exposed systems was Open WebUI, a popular front-end for local large language models (LLMs), with 18,529 reachable instances identified. Only one of these instances exhibited an HTTP authentication challenge. Other widely exposed platforms included vLLM (4,880 endpoints, three with authentication), LocalAI (150 endpoints, none with authentication), and llama.cpp (69 endpoints, none with authentication).
A particularly concerning discovery involved Ollama servers. Mysterium VPN researchers were able to confirm anonymous access directly from the service response itself, as an exposed Ollama server returns the text "Ollama is running" from its root endpoint without requiring credentials. They identified 6,935 hosts displaying this fingerprint, with 6,046 explicitly returning an HTTP 200 response. This level of exposure not only allows unauthorized parties to view installed models but also to utilize the owner's hardware for text generation, leading to resource abuse, commonly termed "LLMjacking."
The scope of this issue may be even broader. A separate study conducted by SentinelOne and Censys in January identified approximately 175,000 publicly exposed Ollama hosts across 130 countries, with nearly half supporting tool-calling capabilities that could execute code or interact with external systems. Mysterium's figures, derived from a different scanning source and stricter fingerprinting, are considered a lower bound.
Beyond the models themselves, the study also focused on exposed agent builders and workflow platforms, finding 5,223 such instances. These systems, including Flowise, n8n, ComfyUI, Dify, RAGFlow, Langflow, and Open WebUI Pipelines, pose a heightened risk because they often integrate AI models with other critical company infrastructure. Automation workflows on these platforms can store sensitive information such as OpenAI API keys, database credentials, Slack tokens, webhook secrets, and CRM passwords.
Flowise serves as a prime example, with 1,341 reachable instances found by Mysterium, none of which presented an HTTP authentication challenge. This is particularly concerning given a critical Flowise vulnerability, CVE-2026-40933, which allows an authenticated attacker to execute arbitrary commands via the MCP adapter. While Flowise addressed this flaw in version 3.1.0, the combination of internet exposure and potential vulnerabilities significantly increases the attack surface for credential compromise.
The problem extends beyond software vulnerabilities. Research by GitGuardian in August uncovered n8n API tokens exposed in public GitHub commits. They identified 4,576 unique tokens linked to 1,255 hostnames. Of the 896 reachable instances tested, 321 accepted at least one of these leaked tokens, demonstrating that attackers can gain access to workflows and connected systems without exploiting a software flaw, simply by using compromised credentials. This underscores a broader challenge for AI security, particularly as organizations increasingly adopt automation platforms.
