AI infrastructure exposure and missing authentication: what teams miss

TL;DR: Exposed AI infrastructure is still shipping with missing authentication, hardcoded credentials, and open agent workflows, and Intruder’s research found 1,652 Ollama APIs, 92 Flowise instances, 25 Langflow instances, and 24 Open WebUI instances exposed without proper controls. The pattern is less about AI novelty than about old identity failures reappearing in faster, broader deployments.

NHIMG editorial — based on content published by Intruder: exposed AI infrastructure, missing authentication, and insecure defaults

By the numbers:

• 1,652 Ollama APIs were exposed with no authentication, out of more than 5,200 exposed to the internet.
• 92 Flowise instances exposed agentic workflows, prompts and integrations, out of more than 2,650 exposed to the internet.
• 25 Langflow instances did not implement authentication, out of more than 300 exposed to the internet.

Questions worth separating out

Q: What breaks when AI runtimes are deployed without authentication?

A: Without authentication, the service becomes a reachable trust boundary rather than a controlled internal capability.

Q: Why do static credentials create more risk for AI agents than for traditional workloads?

A: AI agents execute quickly, can chain actions across systems and may terminate before manual review ever happens.

Q: How do teams know if AI access is too broad?

A: AI access is too broad when a tool can read, write, and export data beyond the immediate task or when the credential remains valid after the use case changes.

Practitioner guidance

• Enforce authentication on every AI endpoint Block public access to chat, inference, and orchestration interfaces until each service has a named identity boundary, enforced authentication, and explicit authorization for every connected function.
• Inventory and rotate AI-connected secrets Find credentials embedded in docker files, examples, notebooks, and workflow definitions, then move them into centrally managed rotation with tight scoping and revocation.
• Classify agent workflows as privileged systems Review Flowise-style and n8n-style automations as privileged control planes, because exposed prompts, routing logic, and tool permissions can reveal or extend access.

What's in the full report

Intruder's full research covers the operational detail this post intentionally leaves for the source:

• Detailed inventory of exposed AI services, including per-technology counts and the exact exposure patterns observed.
• Examples of open agent management platforms, chatbot instances, and model endpoints with missing authentication or visible credentials.
• Lab findings on insecure defaults, hardcoded credentials, and root-running deployments that create broader attack paths.
• Notes on newly discovered vulnerabilities and the disclosure context behind them.

👉 Read Intruder's analysis of exposed AI infrastructure and missing authentication →

AI infrastructure exposure and missing authentication: what teams miss?

Explore further

View Full Forum →  |  NHI Foundation Course →