n8n, the most common of these tools, was running a version with at least one recent critical security flaw on 76% of the systems where Censys could detect n8n installations.
Key Takeaways
- n8n, a tool that links AI to a company’s other software and stores logins, was running a version with at least one critical security flaw on 76% of the systems where Censys could see which version was installed. The flaws were made public between December 2025 and May 2026.
- In July 2026, anyone on the internet could reach 267,915 computers running AI tools, up 63% from October 2025.
- n8n was the most common of those AI tools, on nearly 114,000 of the computers.
- Control panels for OpenClaw, an AI assistant that connects to people’s email and social media accounts, went from just 2 reachable online in January 2026 to 85,478 in April 2026.
Censys, a cybersecurity company, found more than 260,000 computers running AI tools that anyone online can reach. The most common of these tools, n8n, connects a company’s AI to other software, such as Slack and Google Drive, and stores each login. Of the n8n systems where Censys could detect n8n installation, 76% were running a version with at least one recent critical security flaw. The figures come from Censys’s 2026 State of the Internet Report.
An attacker who gains access to one of these tools can use its stored logins to reach other company systems, such as Slack, Google Drive, and databases. The tools are also spreading fast. Installed AI tools that anyone online can reach grew 63% in nine months, and Censys says some companies don’t know these tools are running on their systems.
Most AI tools open to the internet are not chatbots
In July 2026, Censys found 267,915 computers running AI tools that anyone online could reach, up from 164,088 in October 2025. It counted 44 different AI products, but 82% of the computers were running at least one of these five:
- n8n (nearly 114,000): It started as a way to link business software such as Slack, GitHub, Google Drive, and databases. It now also links those services to AI models and to AI agents, programs that carry out tasks on their own.
- OpenClaw (about 54,000): An AI assistant that people connect to their email and social media accounts so it can answer messages and post for them.
- New API (about 24,000): A single entry point that passes requests on to different AI models.
- Ollama (about 23,000): Software for running AI models on an organization’s own computers.
- OpenWebUI (about 19,000): A chat screen for using AI models.
Most n8n systems had a critical flaw
n8n keeps the logins for every service a company connects it to. Censys says that means an attacker who breaks into a company’s n8n can also get into those services, not just n8n.
More than 80 security flaws in n8n were made public in about nine months. Censys could identify the version installed on 89% of the n8n systems it found. Of those, 76% were running a version affected by at least one flaw published between December 2025 and May 2026 and rated critical, meaning 9 or higher out of 10 in the U.S. government’s public database of known software flaws.
n8n releases new versions frequently. Censys found that a typical n8n system was running a version 111 days old, and n8n had released 103 newer versions since then.
In January 2026, attackers also posted fake add-ons to n8n’s add-on library, which users can install from inside n8n. At least eight were reported to steal the logins stored in n8n while n8n ran.
OpenClaw shows how fast a new AI tool can spread
Many users set OpenClaw up wrong. Only the owner should be able to access the control panel, which controls the assistant and every account connected to it. However, tens of thousands of users left it open to the internet, so anyone online could find it. Censys says users set it up “without fully understanding the security implications.”
OpenClaw added the control panel on January 5, 2026. Six days later, Censys found two control panels that anyone could reach online. By February 3, the number was 17,355. On April 7, the count peaked at 85,478, then fell to 54,375 by July 7.
One flaw in OpenClaw could let an attacker take control of a user’s assistant and the accounts connected to it through a link the user opens.
Censys says the exposed OpenClaw panels probably affected hobbyists more than companies. But it says the bigger lesson is speed. OpenClaw went from 2 exposed panels to more than 85,000 in under three months, faster than security practices can keep up. Censys says the worst case is an employee connecting a tool like OpenClaw to a work email account and internal systems without anyone overseeing it.
Why do so many AI tools end up open to the internet?
Censys says one reason is that AI coding assistants make building software much faster. With them, a developer can go from an idea to a working program in an afternoon. Censys says people working that fast often skip secure setup steps and accidentally leave tools exposed to the internet.
Censys also says companies sometimes don’t know AI tools are running on their systems, for example, when an employee’s coding assistant connects to outside AI services on its own.
Being open to the internet does not mean a system is compromised
Censys looks only at what anyone can see from outside and never logs in to the systems it finds. It cannot tell whether a system can actually be broken into, whether other protections are in place, or whether it has already been hacked.
Censys says this is the first edition of the report designed to repeat the same measurements each year, and it expects the list of AI products to change heavily in 2027.
