Ann Arbor – October 14, 2026 -- Internet-facing AI infrastructure grew 63% in nine months to nearly 268,000 systems, according to the fifth annual State of the Internet Report from Censys. The report also counts roughly 134,000 Internet-exposed hosts running industrial control systems (ICS). About 70% of those sit on consumer and mobile networks, which complicates efforts to identify their owners and close the exposure.
n8n and OpenClaw dominate exposed AI tooling
The Censys Advanced Research Collective (ARC) drew on historical and real-time data from the Censys Internet Map. The exposed AI category covers chatbots as well as the tools that connect AI to data, applications and user accounts.
Workflow automation platform n8n is the most widely exposed AI product, at nearly 114,000 hosts. OpenClaw, a personal AI agent assistant, follows with about 54,000. The U.S. (62,687 systems), China (42,511) and Germany (31,222) together account for just over half of all exposed AI infrastructure.
North America holds 38% of exposed ICS hosts
As of 2026, North America accounts for roughly 38% of the exposed global ICS landscape. Europe follows with 32% and Asia with 25%. Roughly 70% of hosts running ICS devices and services worldwide are consistently found on consumer and mobile networks.
China hosts 36.6% of malicious infrastructure, the U.S. 45.5% of web threats
Threat infrastructure splits along geographic lines. China hosts 36.6% of malicious host-level infrastructure such as command-and-control servers and remote access tooling, against 16.8% for the U.S.
The pattern reverses for web-based threats such as phishing and other deceptive pages. The U.S. hosts 45.5% of those observed by Censys, and China hosts 20.9%.
Oldest software versions persist across four studied products
Censys tracked Progress Telerik Report Server, Jenkins, Cleo MFT and Microsoft SharePoint Server. Organizations adopted newer versions of all four products. The oldest versions in use, however, remained largely unchanged throughout the study period.
Zakir Durumeric, Co-Founder and CEO of Censys, said that "identifying and continuously monitoring Internet-facing systems is essential" to realizing AI's value without introducing unmanaged risk.
The report is available for download. The Censys ARC team will host a webinar with a live Q&A on the findings.