Internet-exposed AI tools and ICS exposures are rising fast

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Censys's report: Internet-exposed AI tools and ICS services are expanding, with the report highlighting rapid AI exposure growth, persistent ICS exposure, and the operational risks of public-facing infrastructure.

Why it matters: This matters because exposed AI services, proxies, and ICS assets create attack surfaces that identity, access, segmentation, and asset governance teams must inventory and constrain before exploitation starts.

By the numbers:

• AI/LLM tool exposures have risen over 60% in the past 9 months.
• Langflow grew 169% in the last nine months.

Context

The core issue is Internet exposure governance: when services, tools, and industrial systems are reachable from the public Internet, the attack surface expands faster than most organisations can inventory it. That problem is especially acute for AI infrastructure, where authentication gaps, exposed admin planes, and embedded credentials can turn a single endpoint into a broad compromise path.

Censys's longitudinal measurement is useful because it tracks exposure over time rather than treating incidents as isolated events. The report also surfaces a familiar pattern for identity and access teams: systems become risky not only when they are new, but when they are publicly reachable, poorly segmented, and left with unnecessary trust assumptions.

Key questions

Q: How should teams reduce the risk of exposed AI credentials being abused?

A: Treat AI-connected secrets as high-priority NHIs and minimise their lifespan, scope, and exposure paths. That means continuous discovery, immediate revocation when leaks are found, and access policies that limit what a stolen key can reach if it is validated by an attacker.

Q: Why do exposed internet-facing systems create such a high-risk window for attackers?

A: Exposed systems reduce the time attackers need to move from discovery to exploitation. Once a vulnerable service is reachable from the internet, scanning is automated and attack attempts can begin quickly, often before defenders have patched or even finished inventorying exposure. That is why external attack surface management and rapid remediation matter together.

Q: What are the signs that exposed infrastructure is not under control?

A: Common signals include unknown public IPs, services exposed from consumer or mobile networks, repeated exposure after advisories, and platforms whose credential dependencies are not mapped. If those signals exist, the organisation does not have a stable exposure governance process and should treat discovery as incomplete.

Q: How should organisations balance exposure reduction and vulnerability patching?

A: They should treat them as complementary controls, but not equivalent priorities. Patch management reduces known flaw risk, while exposure reduction prevents unnecessary attack paths from existing in the first place. When time is limited, removing public reachability often reduces risk faster than waiting for a patch cycle to complete.

Technical breakdown

Why exposed AI tooling becomes a credential and access problem

Publicly reachable AI tools are not just application endpoints. Many expose configuration interfaces, model proxies, orchestration layers, or workflow engines that rely on API keys, bearer tokens, and upstream service credentials. If those interfaces are unauthenticated, weakly authenticated, or reachable from the Internet without network restrictions, the resulting compromise can extend well beyond the tool itself. A unified LLM proxy is especially sensitive because it can concentrate access to multiple downstream providers. That makes one exposed service a multiplier for credential theft, misuse, and cross-environment trust abuse. See the AI Security Maturity Model.

Practical implication: Treat exposed AI tools as privileged access surfaces and require strong authentication, inventory, and network scoping before they are Internet reachable.

What ICS exposure tells us about perimeter assumptions

ICS exposure is a governance problem as much as a network problem. When industrial services remain accessible from consumer and mobile networks, the organisation is relying on perimeter placement, obscure routing, or undocumented reachability as a security control. That assumption fails when exposed hosts are discoverable at scale. The report's regional and network-distribution findings matter because they show exposure is not limited to a single sector or geography. In practical terms, asset ownership, segmentation, and remote-access policy determine whether exposure becomes an exploitable path or just a measurement result.

Practical implication: Map externally reachable ICS assets to explicit owners and remove public exposure wherever the business does not require it.

Why exposure trends matter more than point-in-time vulnerabilities

The report is describing a measurement model, not a single exploit campaign. That distinction matters because exposure persistence often outlives disclosure cycles. A system can remain externally visible long after CVEs, KEV entries, or advisories identify the risk. For identity teams, the parallel is clear: once a service or tool is Internet-facing, access governance must shift from periodic review to continuous control over who can reach it, how it authenticates, and what credentials it uses. Exposure visibility becomes the prerequisite for any downstream remediation.

Practical implication: Use continuous internet exposure monitoring to prioritize systems that remain reachable after advisories or exploitation alerts.

Threat narrative

Attacker objective: The attacker aims to turn public reachability into durable access, credential exposure, or operational disruption across AI and industrial environments.

1. Entry begins when an attacker discovers an Internet-exposed AI tool or ICS host through public scan data and reconnaissance.
2. Escalation follows when weak authentication, embedded credentials, or exposed administrative interfaces allow unauthorized access to the service or its connected systems.
3. Impact occurs when the exposed service is used to steal API keys, execute code, manipulate industrial processes, or extend access into dependent environments.

Breaches seen in the wild

• Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Internet exposure is becoming an identity governance issue, not just an asset discovery problem. When AI tools and operational technologies are reachable from the public Internet, the real question is who can authenticate, what trust they inherit, and whether those trust paths are intentionally designed. Discovery without access governance still leaves a service exposed, but discovery plus identity controls at least creates a path to contain it.

AI infrastructure concentrates privilege in ways that traditional application inventories often miss. A proxy, orchestrator, or automation framework can hold credentials for multiple upstream services and model providers, turning one reachable interface into a privilege multiplier. That is why AI security maturity matters here: exposure management without agent and tool identity governance leaves the highest-risk access paths intact.

Operational technology exposure is a segmentation test, not a geography story. The report's regional distribution matters, but the deeper signal is that exposed ICS assets persist on consumer and mobile networks because ownership, routing, and remote access were never forced into a tighter control model. The governance gap is not merely visibility; it is the absence of enforceable placement and access boundaries for systems that should rarely be Internet reachable.

Exposure monitoring needs to become a control input, not a reporting output. Longitudinal measurement is useful only if it changes remediation priority, exception handling, and review cadence. In both AI and ICS contexts, the organisations that act fastest will be the ones that tie exposure data to ownership, authentication, and external-access decisions rather than treating it as a dashboard metric.

What the report calls 'Internet exposure' is increasingly the first step in a compromise chain. The moment a service is publicly discoverable, the attacker no longer needs to solve inventory. The control objective shifts to shrinking the attackable surface before credentials, administrative planes, or downstream dependencies can be targeted.

What this signals

Internet exposure management is becoming a continuous governance function. The pace of AI tool adoption and the persistence of ICS exposure mean that periodic audits are no longer enough. Security teams need exposure data wired into ownership, access policy, and external-facing change control so that newly visible services do not remain exposed by default.

Credential concentration is the hidden risk in many AI deployments. When a single proxy or orchestration layer can reach multiple upstream providers, the security boundary is not the application itself but the credentials behind it. That makes identity, secrets, and network segmentation inseparable in any meaningful exposure reduction programme.

Exposure trends now influence threat prioritisation as much as CVE lists do. If a service is both widely deployed and widely reachable, it belongs at the front of remediation queues even before a confirmed exploit is seen. Public visibility is often the earliest and most reliable signal that a control problem is already forming.

For practitioners

• Inventory exposed AI and ICS services continuously Create an externally reachable asset register that includes AI tools, proxies, orchestration layers, and ICS-facing hosts, then reconcile it against business ownership and approved exposure.
• Remove unauthenticated public access to AI tooling Place AI tools, admin consoles, and model proxies behind strong authentication, network restrictions, and explicit approval for any Internet exposure.
• Map exposed services to credential dependencies Identify which API keys, tokens, or service accounts each exposed platform can reach so a single compromise cannot cascade into multiple upstream systems.
• Treat ICS exposure as a segmentation failure Review whether externally visible industrial hosts are reachable because of intentional business need or because perimeter and routing controls were never enforced.
• Prioritise remediation by exposure persistence Use recurring measurement to rank systems that remain Internet reachable after advisories, exploit disclosures, or internal review cycles.

Key takeaways

• Internet exposure is not a passive measurement issue. It is a control problem that determines whether AI tools and ICS services can be reached, probed, and abused from outside the environment.
• The report's figures point to a broad and persistent surface area, including more than 294,000 exposed IPs for AI tools and about 134,000 exposed ICS hosts in early 2026.
• Practitioners should tie exposure data to ownership, authentication, segmentation, and remediation priority so public reachability does not become the default security state.

Related NHI Mgmt Group resources: AI Security Maturity Model · Vendor Security Assessment Template · NIST SP 800-30 Risk Assessment Guide

Key terms

• Internet Exposure: Internet exposure is the degree to which a system, service, or identity-backed interface can be reached from outside the organisation. It is not a simple yes-or-no attribute. Exposure changes with configuration, deployment, and network controls, and it directly affects how quickly an attacker can turn a weakness into access.
• AI Infrastructure Platform: An AI infrastructure platform is software that supports teams building and deploying machine learning models themselves rather than embedding AI directly into a business function. These platforms can cover parts of the workflow such as training, evaluation, deployment, monitoring, governance, or explainability, depending on their scope.
• Exposure Persistence: Exposure persistence is the condition where risk remains active after the initial incident because access, data paths, or systems have not been fully removed or isolated. It is a governance failure as much as a technical one, because unrevoked trust keeps the breach relevant.
• Operational technology exposure: Operational technology exposure is the condition where industrial control systems are reachable in ways that were not intended by their designers or operators. When these systems are exposed, cyber events can create physical or process disruption, not only information loss.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.