Key Takeaways
- North America hosts about 38 % of all internet‑exposed industrial control systems (ICS) worldwide, the largest regional share as of early 2026.
- Publicly reachable AI services have surged, with >294,000 IP addresses linked to AI tools in early 2026—up 61 % from October 2025.
- Frequently deployed AI components such as Langflow and LiteLLM are riddled with high‑severity vulnerabilities, making them attractive targets for attackers seeking remote code execution or credential theft.
- Although the absolute number of exposed ICS devices rose modestly from 129,000 (2024) to 138,000 (early 2026), their geographic distribution is shifting: Asia’s share grew from 23 % to 27 %, while Europe’s fell from 36 % to 31 %.
- Roughly 70 % of globally exposed ICS hosts reside on consumer and mobile networks, underscoring that critical‑infrastructure gear is often reachable via the same connections used by households and smartphones.
- The convergence of expanding AI attack surfaces and persistent ICS exposure creates a heightened risk landscape for sabotage, data theft, and disruption of essential services.
Overview of Findings
The latest preview of Censys’s annual internet exposure report reveals two parallel trends that together widen the attack surface for malicious actors. First, industrial control systems—hardware that manages power grids, water treatment, hospitals, and other critical infrastructure—are increasingly visible on the public internet. Second, the proliferation of AI‑related services accessible without authentication is accelerating, providing hackers with new vectors to compromise machine‑learning pipelines and steal sensitive credentials. By quantifying the number of exposed ICS devices and AI service IP addresses, Censys offers a snapshot of where defenders should focus their monitoring and mitigation efforts. The data underscore that both legacy operational technology and emerging AI infrastructure are now routinely reachable from the open internet, a situation that demands urgent attention from security teams, asset owners, and policymakers alike.
North America’s Dominance in ICS Exposure
North America continues to host the largest proportion of internet‑exposed ICS devices, accounting for roughly 38 % of the global total in early 2026. This share reflects the continent’s extensive deployment of automated systems in energy distribution, manufacturing, and transportation, many of which remain inadequately segmented from corporate or consumer networks. While the absolute number of exposed ICS hosts grew only modestly—from 129,000 in 2024 to 138,000 in early 2026—their concentration in North America means that a disproportionate share of potential sabotage or ransomware targets lies within the United States and Canada. The persistence of this regional concentration highlights the need for stronger network‑zoning practices, stricter authentication requirements, and more rigorous vulnerability management for OT assets in the region.
Rapid Expansion of Public AI Services
Censys detected more than 294,000 IP addresses associated with AI services in early 2026, a marked increase from the 183,000 observed just six months earlier. This growth mirrors the broader industry trend of embedding AI capabilities into cloud‑native applications, APIs, and developer tools that are often exposed to facilitate integration and experimentation. Many of these services are designed for ease of use, sometimes at the expense of security controls such as network segmentation, mutual TLS, or strict access policies. Consequently, each new AI endpoint expands the potential attack surface, offering adversaries opportunities to probe for weaknesses, inject malicious models, or exfiltrate training data and proprietary algorithms.
Langflow: A Proliferating yet Vulnerable AI Agent Builder
Among the AI tools surveyed, Langflow experienced the most dramatic rise in visibility, with Censys recording a 169 % increase in internet‑exposed instances over the past nine months. Despite its popularity as a low‑code platform for constructing AI agents, Langflow has accumulated 18 vulnerabilities since 2024, of which 14 are rated high‑severity and four have already been observed in exploitation attempts. Notably, multiple unauthenticated remote code execution (RCE) flaws allow an attacker who can reach a Langflow instance to execute arbitrary commands on the underlying host, potentially pivoting to internal networks or compromising the AI models being built. The combination of rapid adoption and severe security gaps makes Langflow a prime candidate for targeted attacks aimed at stealing intellectual property, inserting backdoors into AI workflows, or leveraging compromised agents for further intrusion.
LiteLLM: Centralized LLM Access Point with Critical Flaws
Another widely adopted AI utility, LiteLLM, saw its internet‑exposed presence nearly double during the same observation window. LiteLLM functions as a unified gateway that connects applications to various commercial large language models (LLMs), meaning that a successful breach can expose the API keys and credentials for all linked services. Censys reports that attackers continue to exploit a pre‑authentication SQL injection vulnerability in LiteLLM, enabling unauthorized access to its backend database. Such access could lead to credential theft, manipulation of model requests, or the injection of malicious prompts that cause downstream applications to behave unexpectedly. Because LiteLLM aggregates access to multiple LLMs, its compromise amplifies the impact far beyond a single service, posing a significant supply‑chain risk for organizations that rely on heterogeneous model providers.
Global ICS Trends: Shifting Regional Balance
While North America retains the largest share, the geographic distribution of exposed ICS devices is evolving. Asia’s proportion rose from 23 % in 2024 to 27 % in early 2026, reflecting growing automation in manufacturing, smart‑city projects, and utility modernization across the region. Conversely, Europe’s share declined slightly from 36 % to 31 %, possibly due to stricter regulatory pressure, improved network segmentation, or more proactive vulnerability remediation. The overall number of exposed ICS hosts increased only modestly, indicating that the absolute exposure level is relatively stable, but the shifting regional mix suggests that threat actors may begin to focus more on Asian assets as defenses improve elsewhere.
Network Environment of Exposed ICS
A striking characteristic of the global ICS exposure landscape is that roughly 70 % of hosts running ICS devices and services are consistently found on consumer and mobile networks, a pattern that has persisted for the last 2.5 years. Business networks and cloud platforms account for considerably smaller portions—estimated at around 25 % and 5 %, respectively—based on Censys’s internal charts. This distribution implies that much of the critical‑infrastructure gear is reachable via the same residential or mobile connections used by everyday consumers, often because OT devices are placed behind residential‑grade routers, lack proper firewalls, or are inadvertently exposed through misconfigured port forwarding or dynamic DNS services. The prevalence of ICS on less‑secured networks amplifies the risk that opportunistic malware, botnets, or ransomware campaigns could inadvertently stumble upon and exploit these assets.
Implications for Critical Infrastructure and AI Supply Chains
The convergence of a growing AI attack surface and persistent ICS exposure creates a dual‑pronged threat environment. Adversaries could seek to sabotage physical processes—such as shutting down power substations or contaminating water supplies—by exploiting exposed OT devices, while simultaneously targeting AI models to manipulate decision‑making processes, steal proprietary algorithms, or poison training data. The presence of high‑severity, unauthenticated vulnerabilities in popular AI building blocks like Langflow and LiteLLM lowers the barrier for attackers with modest technical skill, enabling them to gain footholds that can be pivoted toward more valuable targets. For organizations, this means that traditional OT security programs must be extended to cover AI‑enabled components, and AI development pipelines must incorporate the same rigor applied to legacy industrial systems, including network segmentation, least‑privilege access, continuous vulnerability scanning, and incident‑response planning.
Recommendations for Defenders
- Asset Discovery and Classification – Continuously scan for both ICS and AI service endpoints on public IP space, tagging them by criticality and data sensitivity.
- Network Segmentation – Place OT devices and AI service hosts behind dedicated firewalls or zero‑trust zones, preventing direct exposure from consumer or mobile networks.
- Vulnerability Management – Prioritize patching or mitigating known high‑severity flaws in Langflow, LiteLLM, and other widely used AI tools; consider virtual patching or web‑application firewalls where immediate patches are unavailable.
- Authentication and Authorization – Enforce strong, multi‑factor authentication for all administrative interfaces; disable unauthenticated access wherever feasible.
- Monitoring and Threat Intelligence – Feed exposure data from sources like Censys into SIEMs and threat‑hunting platforms to detect anomalous connections or exploit attempts in real time.
- Incident‑Response Planning – Develop and test playbooks that address both OT‑specific impacts (e.g., process shutdown) and AI‑specific impacts (e.g., model poisoning or credential theft).
- Vendor Collaboration – Engage with suppliers of ICS equipment and AI platforms to ensure secure‑by‑design principles, request regular security updates, and verify that default configurations do not expose services to the internet.
By adopting these measures, organizations can reduce the likelihood that their critical infrastructure or AI assets become low‑hanging fruit for attackers seeking to disrupt operations, steal intellectual property, or pivot deeper into corporate networks. The data from Censys serve as a timely reminder that as technology advances, so too must the defenses that safeguard the systems upon which modern society depends.