Mysterium VPN has identified 36,769 self-hosted AI endpoints that were reachable from the public internet, with only 741 returning an HTTP authentication challenge during the company’s scan.
The findings, published on September 10, 2026, cover model servers, AI agent and workflow platforms, and vector-store interfaces. Mysterium said the research was designed to measure how much self-hosted AI infrastructure is accessible online and how often those services are protected by a network-level authentication layer.
The company said the 36,769 endpoints were identified through Netlas, a third-party internet scanning index. Researchers said they did not directly contact the machines, retrieve their data, run inference, exploit vulnerabilities or publish hostnames and IP addresses.
Of the total endpoints, 741, or about 2.02%, returned HTTP 401 or 403 authentication challenges. Mysterium stressed that the figure should not be interpreted as proof that every other service had no application login. Instead, it shows that most of the identified systems did not present an HTTP authentication barrier detectable through the research methodology.
The largest group was Open WebUI, with 18,529 reachable instances. Only one returned an HTTP authentication challenge.
Open WebUI is widely used as a web interface for locally hosted AI models. Mysterium said a publicly reachable web application is not necessarily an unauthenticated application, because it can still display an application-level login page. Its finding is narrower: almost none of the identified instances had a separate network or HTTP authentication gate in front of the service.
Ollama was another major part of the census. Mysterium identified 6,935 Ollama servers that responded to anonymous requests with the service’s “Ollama is running” response.
The researchers said 6,046 of those servers returned HTTP 200 responses, while 729 returned an authentication challenge. Because the root response provides a recognizable Ollama fingerprint, Mysterium said this particular finding provides stronger evidence of anonymous access than simply counting open ports.
Ollama is designed to bind to localhost by default, but its service can become publicly reachable when configured to listen on a public interface. Separate research from SentinelLABS and Censys published in January 2026 identified 175,108 unique Ollama hosts across 130 countries during 293 days of scanning, showing that Mysterium’s 6,935 figure should be treated as a measurement from its specific methodology rather than a count of all exposed Ollama systems worldwide.
The Mysterium census also identified 4,880 vLLM endpoints, with three returning an HTTP authentication challenge. LocalAI accounted for 150 endpoints, while llama.cpp server accounted for 69.
The research found a separate group of 5,223 AI agent builders and workflow platforms. These included 1,341 Flowise instances, 891 RAGFlow instances, 792 Dify instances, 788 ComfyUI instances, 675 n8n instances, 472 Open WebUI Pipelines instances, 250 Langflow instances and 14 Gradio applications.
Mysterium identified no HTTP authentication challenges among the 1,341 Flowise endpoints in its scan.
Agent and workflow platforms received particular attention in the research because they can be connected to external services and may contain credentials, tokens and business workflows. Mysterium did not claim that the identified systems exposed those credentials, but said the platforms represent a potentially more sensitive class of infrastructure because of the information and integrations they can hold.
The security implications are not limited to AI model generation. An exposed model server can provide unauthorized access to computing resources, while an exposed automation or agent platform can potentially provide a path toward connected services if authentication and other controls are absent or misconfigured.
Recent security research illustrates the separate risks associated with these platforms. GitHub’s advisory for CVE-2026-40933 describes a critical Flowise vulnerability affecting versions up to 3.0.13. The flaw could allow an authenticated attacker to add an MCP stdio server containing an arbitrary command and achieve command execution. The advisory lists version 3.1.0 as the patched version.
Additional Flowise advisories published in 2026 describe other critical vulnerabilities affecting versions up to 3.1.2, including vulnerabilities involving sandbox escapes and code execution. Those vulnerabilities do not establish that the Flowise systems identified by Mysterium were vulnerable or compromised.
n8n has also been the subject of separate credential-exposure research. In August 2026, GitGuardian reported finding 4,576 unique n8n API tokens in public GitHub commits, associated with 1,255 hostnames. Of 896 publicly reachable instances examined, 321 accepted at least one leaked token.
The Hacker News report on the GitGuardian research said those 321 instances represented about 36% of the reachable systems tested. GitGuardian also identified 372 n8n Model Context Protocol API keys, seven of which were still valid when tested.
Mysterium also found 920 vector-store endpoints, although it said this part of the census was significantly undercounted. The tally consisted largely of 914 Milvus Attu web consoles and six Weaviate instances because the source used for the research could not properly scan the native ports used by some vector databases.
Vector stores can hold information used by retrieval-based AI systems, including documents and other data supplied to models. However, Mysterium did not claim that the identified vector stores exposed their underlying databases or contents.
The company described its total of 36,769 endpoints as a floor rather than a complete measurement of publicly reachable AI infrastructure. Five of the 17 products in the census did not produce resolved authentication counts because of rate limits affecting the source data.
Mysterium’s methodology also excluded services where a port number alone could not establish the identity of the software. For example, the researchers observed 22,024 responses associated with Ollama’s default port 11434 but counted only the 6,935 responses that returned the expected Ollama fingerprint.
The research was conducted on August 30 and 31, 2026, using indexed responses rather than direct interaction with the identified machines.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
