36,769 self-hosted AI endpoints are reachable online — 2.02% gated

Mysterium VPN researchers counted 36,769 self-hosted AI endpoints reachable and self-identifying on the public internet, and found that only 741 of them (2.02%) answered an anonymous request with an HTTP authentication challenge. For anyone running open-weight models on their own hardware for privacy, the study is the uncomfortable counterweight: running the model yourself delivers nothing if the box itself is reachable.

Key facts

• 36,769 endpoints across 17 products were reachable and self-identifying in the Netlas scanning index; 741 returned an HTTP authentication challenge, a 2.02% gate rate.
• 18,529 Open WebUI instances were reachable; exactly one sat behind an auth gate.
• 6,935 Ollama servers returned the anonymous "Ollama is running" banner, 6,046 of them with an explicit HTTP 200; Ollama's 10.5% gate rate is the highest in the census and still leaves nine in ten with nothing in front of them.
• 4,880 vLLM endpoints were reachable, with 3 gated.
• Flowise: 1,341 reachable, zero gated, and the family carries a live remote-code-execution flaw, CVE-2026-40933.
• 5,223 agent-builder endpoints span Flowise, n8n, ComfyUI, Dify, RAGFlow, Langflow and Pipelines, the class that stores credentials to everything else.

What happened

The census is a count, and the discipline behind it is what makes the count credible. Mysterium used the public query interface of Netlas, an internet-wide scanning index, and asked how many indexed responses match a given service fingerprint, using data Netlas had already collected on August 30–31, 2026. The researchers state plainly what they did not do: no host was contacted directly, no model list or prompt or chat log was retrieved, no credential was read, and no inference was run on anyone's GPU. The headline protection metric is the authentication-challenge rate: a 401 or 403 is evidence of a gate, while a 200 is not proof of its absence, because a login page also returns 200.

The census covers three classes. Model servers dominate the raw numbers: 18,529 Open WebUI instances, 6,935 Ollama hosts answering the banner, 4,880 vLLM, 150 LocalAI, and 69 llama.cpp servers, per the census table. Agent builders add up to another 5,223 endpoints: Flowise, RAGFlow, Dify, ComfyUI, n8n, Pipelines, Langflow, Gradio. Vector stores contribute 920, nearly all Milvus's Attu console (914) plus six Weaviate instances.

For Ollama, the claim can be strong, because the fingerprint is itself proof: the API's root path returns the plain-text string "Ollama is running" to any anonymous request, and it exists only when the API is reachable without credentials. 6,935 hosts returned it. Everything past that point, listing the models on the machine, generating text on the owner's GPU at the owner's expense, what the security community calls LLMjacking, is exactly what the researchers declined to test. "We counted the doors. We didn't open them."

The agent-builder class is where the numbers stop being a hobbyist problem. A model server exposes capability; an agent builder exposes credentials: the OpenAI key, the database login, the Slack token, the webhook secret that a workflow needs to reach the rest of the company. That is the product's core function, so an exposed Flowise or n8n instance is closer to an exposed credential vault with business logic attached than to an exposed chatbot. The wider record already shows what follows: in August 2026 researchers reported 321 live n8n instances that accepted API tokens harvested from public GitHub commits, no vulnerability required, just a leaked token and a reachable host. GitGuardian has documented how a leaked n8n key can expose the instance's encryption key protecting every stored credential, and Flowise carries the live CVE-2026-40933 remote-code-execution flaw in the family. Against that record, Flowise's 1,341 reachable endpoints with zero authentication challenges is the number a security team should read twice.

Why it matters

The privacy argument for self-hosting is simple and real: your prompts and documents stay on your hardware instead of somebody else's. That argument holds only if nobody else can reach your hardware. What this census shows is that the entire category of self-hosted AI software is, as deployed, overwhelmingly without a network perimeter: no reverse proxy, no basic auth, no gateway, no IP allowlist. Whatever protection exists lives inside the application, in the layer where CVEs, default credentials and misconfigurations live. For software this young and shipping this fast, betting on every deployment having no bugs is a large bet.

The finding is also deliberately narrower than it may look. The researchers are explicit that this is not a vulnerability report: Ollama, Open WebUI, Flowise and n8n are not broken products. They are doing what they were designed to do: run on a machine and serve a local user. The failure is deployment, and that makes it fixable: bind to localhost, put an authenticating gate in front of anything remote, treat an agent builder as a secrets store, and use the census fingerprints to check your own organization's exposure in any scanning index.

Background

This is the second internet-wide measurement of self-hosted AI infrastructure DeAI has covered in a week, and the two studies bracket each other. The Nankai University longitudinal scan counted 152,137 cumulative IPs serving Ollama's unauthenticated port-11434 API over a full year and found in-place patching rates between 0.43% and 2.90% across five tracked CVEs. Mysterium cites that same ~175,000 Ollama population as context for why its own 36,769-endpoint total is a floor: one scanning index, one vantage point, and two major vector databases it could not see at all.

The vector-store blind spot may be the most consequential caveat. The census's 920 vector-store endpoints consist almost entirely of web consoles, because the index does not scan Qdrant's native port (6333) or Milvus's (19530). A model server exposes capability, an agent builder exposes credentials, and a vector store exposes the embedded contents of whatever corpus was indexed into it: internal documents, support tickets, customer records. The researchers report the 920 as a floor for the class where the true number is likely highest.

The pattern extends beyond hobby deployments. DeAI's coverage of the LiteLLM MCP authentication-bypass incident showed server-side inference tooling entering CISA's Known Exploited Vulnerabilities catalog, and TEE-backed confidential inference raises the ceiling on what verifiable privacy can look like, but no enclave helps a deployment whose API port answers the whole internet. For teams weighing self-hosting against renting an API, the honest ledger now includes hardening labor on the self-hosting side, because at internet scale the assumption that "everyone firewalls their box" is simply false.

What's next

Three things to watch. First, whether Ollama changes its default bind or adds authentication; its documented protection today is "don't expose it," and the census gives that posture a number. Second, whether the 321-instance n8n token-harvesting episode and CVE-2026-40933 push agent-builder vendors toward secure-by-default deployments, since that class stores credentials by design. Third, whether a follow-up census with broader port coverage moves the vector-store figure off its floor — that is where the content lives, and today nobody can measure it well. In the meantime, the actionable part of this story is the hardening checklist: bind to localhost, gate what must stay remote, and check your own footprint with the same fingerprints the census used.