According to the 2026 State of the Internet Report by Censys, the number of public IP addresses exposing AI and LLM tools has increased by 63% over a nine-month period. As of October 2026, more than 294,000 distinct IP addresses were identified, compared to approximately 183,000 in October 2025.
The report highlights 43 different AI and LLM tools currently exposed to the public internet. Censys noted that companies are prioritizing the deployment of AI infrastructure over implementing necessary security measures, leading to increased vulnerabilities.
Two platforms, Langflow and LiteLLM, showed significant growth alongside security risks. Langflow usage grew by 169%, with 18 reported vulnerabilities between 2024 and 2026. Of these, 14 flaws have a CVSS score exceeding 8.0, and four are listed in the CISA Known Exploited Vulnerabilities catalog.
LiteLLM experienced a 97% increase in exposure. The platform is currently affected by an actively exploited pre-authentication SQL injection vulnerability, identified as CVE-2026-42208. The full report, which also covers industrial control systems, was released around October 8, 2026.
