Security Scan of 1 Million AI Services Reveals Widespread Exposure and Vulnerabilities

A security scan by Intruder of 2 million hosts containing 1 million exposed AI services has revealed unprecedented security vulnerabilities, with researchers calling AI infrastructure the most vulnerable software category they have ever investigated. The assessment found that 31% of over 5,200 Ollama API servers responded to prompts without authentication, while over 90 exposed agent management platforms were discovered across government, marketing, and finance sectors. Critical security failures include hardcoded credentials in setup files, applications running as root, and one exposed instance revealing a user's complete LLM conversation history and API keys in plaintext. The findings indicate AI developers have abandoned established security practices in favor of rapid deployment, with authentication disabled by default and 518 instances wrapping frontier models from major providers like Anthropic, Google, and OpenAI left exposed to potential exploitation.

Widespread Lack of Authentication in AI Infrastructure

• ▪A significant number of AI infrastructure hosts were deployed with no authentication in place.
• ▪Of 5,200+ Ollama API servers queried with a single prompt, 31% answered without requiring authentication.
• ▪Many AI projects drop users straight into a high-privilege account with full management access on fresh installs.
• ▪Over 90 exposed agent management platform instances were identified across government, marketing, and finance sectors.
• ▪Authentication is not enabled by default in many AI infrastructure projects.

Exposed AI Services and Their Security Risks

• ▪The Intruder team scanned over 2 million hosts with 1 million exposed AI services using certificate transparency logs.
• ▪ClawdBot, a self-hosted AI assistant, is averaging 2.6 CVEs per day.
• ▪Of all models identified across scanned servers, 518 were wrapping well-known frontier models from Anthropic, Deepseek, Moonshot, Google, and OpenAI.
• ▪Claude-powered chatbot software disclosed API keys in plaintext.
• ▪Exposed n8n and Flowise agent management platform instances included systems users thought were internal.
• ▪An exposed Flowise instance revealed the entire business logic of an LLM chatbot service and its credential list.
• ▪One exposed OpenUI-based chatbot instance revealed a user's full LLM conversation history.

Systemic Security Failures in AI Development Practices

• ▪Intruder researchers found arbitrary code execution vulnerabilities in one popular AI project within a couple of days of lab work.
• ▪Hardcoded and static credentials are embedded in setup examples and docker-compose files rather than generated on installation in AI projects.
• ▪AI infrastructure projects exhibit poor deployment practices including insecure defaults, misconfigured Docker setups, hardcoded credentials, and applications running as root.
• ▪AI tooling has a distinct absence of proper access management controls.
• ▪The AI infrastructure scanned by Intruder was more vulnerable, exposed, and misconfigured than any other software Intruder has ever investigated.

Perspective of Intruder security research team

• ▪The AI infrastructure scanned represents the most vulnerable and misconfigured software category Intruder has ever investigated in its history.

Perspective of Organizations deploying AI services

• ▪Organizations deploying n8n and Flowise agent management platforms mistakenly believed their systems were internal when they were actually exposed.

2 sources