Research data

Not real-time: served from caches, so a figure can be an hour or more oldIndex computed 2026-11-02 02:44 UTC

AI Security Index

Tracking the growing gap between AI infrastructure deployment velocity and security vulnerability reporting. Powered by Shodan, Certificate Transparency, and NVD. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it.

AI Services Discovered(cumulative)

22,418

AI-Related CVEs(cumulative)

7,402

Confirmed Exposures(current)

1,363

No Auth Required(% of AI services whose auth could be determined)

14.8%

1,362 of 9,229 determined, across the auth-gap chart below

Avg Daily Discovery(avg per day, last 14 days)

1,038

AI Adoption vs. Security Incidents

Each data point is the per-week count (not cumulative). Rolling 26-week window — new data points appear weekly as observations accumulate.

Services

Exposures

CVEs

Data Sources

AI Services: Shodan API sweep (every 12h, when Shodan query credits allow) + crt.sh Certificate Transparency log monitoring (a cycle about once a minute). Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it. Detects 40+ AI service signatures (Ollama, Jupyter, MLflow, Flowise, vector databases, LLM proxies, etc.). Exposures: Subset verified as actively accessible without authentication via DNS + TLS + API probing. CVEs: NIST National Vulnerability Database (NVD) API, filtered by 27 AI/ML keywords. Chart shows weekly aggregations — as weeks pass, up to 6 months of history will be displayed.

Global AI Adoption by Region

All AI services discovered — exposed and secured — showing which regions are deploying AI infrastructure fastest

All Services (not just exposed)

🇪🇺Europe30 countries▶

26.6%5,655

🇺🇸North America3 countries▶

24.7%5,263

🇨🇳China4 countries▶

22.0%4,686

🌏Asia-Pacific12 countries▶

14.4%3,074

🌐Other54 countries▶

3.4%734

🇮🇳India1 country▶

3.2%678

🇦🇪Middle East7 countries▶

2.3%486

🇧🇷South America5 countries▶

2.0%436

🌍Africa8 countries▶

1.3%266

Data Source

Shodan data (swept every 12 hours, when Shodan query credits allow). Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it.Counts every AI service observation that carries a country — secured, authenticated and unverified alike. The country is as reported in Shodan data; Certificate Transparency rows (from crt.sh) carry none and are not counted here. Countries are then grouped into 8 macro-regions.

Exposed by Category

Confirmed unauthenticated AI endpoints by type

1363

Total

LLM Proxy918

Vector DB156

Model Registry110

Notebook89

AI Workflow52

Inference Server38

Source: Shodan API + crt.sh CT logs. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it. Categories assigned by service-signature matching (port, TLS cert CN, HTTP response fingerprint). Only endpoints verified as exposed without authentication.

Exposed Infrastructure by Region

Only endpoints confirmed as unauthenticated / publicly accessible

🇺🇸North America

29%398

🇪🇺Europe

26%357

🌏Asia-Pacific

18%251

🇨🇳China

8%109

🌐Other

6%76

🇮🇳India

5%70

🇦🇪Middle East

3%36

🇧🇷South America

3%36

🌍Africa

2%29

Source: the country Shodan reports for each confirmed exposure (a row whose last check found it answering without authentication). Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it. Countries mapped to 8 macro-regions. A confirmed exposure with no Shodan country, which includes every one found through Certificate Transparency, is not counted here.

AI-Related CVEs by Severity

Weekly from NVD — filtered by 70+ AI/ML keywords & CPE products

Source: NIST National Vulnerability Database (NVD) API. Filtered by 70+ AI/ML keywords + CPE product matching (TensorFlow, PyTorch, Jupyter, NVIDIA, LangChain, Ollama, HuggingFace, OpenAI, and more). CVEs tagged at ingestion with ai_related=true. Severity from NVD CVSS scoring (Critical ≥ 9.0, High ≥ 7.0).

Authentication Gap by Service

Of the Shodan endpoints whose authentication could be determined, the % that accepted unauthenticated requests

Correction, 2026-09-27. From 2026-05-02 to 2026-09-27 this chart showed 100% for every category with any open endpoint and 0% otherwise. Its query looked for a result our verifier never records, so no endpoint was ever counted as requiring authentication and each percentage could only be all or nothing. The figures now use adjudicated endpoints only, those we saw answer without authentication or saw require it, and the percentage is the first group divided by both. Endpoints whose authentication could not be determined are excluded and counted separately; a category with no adjudicated endpoints shows no percentage.

Method note. Once our verifier re-checks a Flowise endpoint under this rule (#2798), a Flowise API that answers with its API-key refusal (HTTP 401) counts as requiring authentication only when its public version endpoint reports Flowise 3.0.1 or later. Flowise 2.0.6 to 3.0.0 send the same refusal even where their own web UI reaches the API with no sign-in, so those, and versions we cannot read or place, become not determined and are left out of the percentage (counted as not determined), unless the service's own page refused us or showed a login page. On 2026-10-04 this would have applied to at most 10 endpoints across the whole radar.

Model Registry

110 / 11397.3%

+ 129 answered, authentication not determined — excluded

Vector DB

156 / 28854.2%

+ 22 answered, authentication not determined — excluded

LLM Proxy

917 / 1,93247.5%

+ 104 answered, authentication not determined — excluded

Inference Server

38 / 22317%

+ 35 answered, authentication not determined — excluded

AI Workflow

52 / 40013%

+ 2,421 answered, authentication not determined — excluded

Notebook

89 / 1,4965.9%

+ 23 answered, authentication not determined — excluded

Annotation

0 / 6640%

+ 12 answered, authentication not determined — excluded

Model Store

0 / 4,1130%

+ 51 answered, authentication not determined — excluded

MCP Server

0 / 0no data

+ 666 answered, authentication not determined — excluded

Source: Shodan discovery → DNS/TLS/API liveness verification. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it. "No Auth" = endpoint returns 200 OK without credentials. The percentage is taken only over endpoints whose authentication was determined: no auth, or authentication observed (a 401/403, a login page, an authentication error in the response, or a redirect to a login page). Endpoints that answered but whose authentication no probe could determine are listed per row and excluded; "no data" means none in that category could be determined. Bar length is the percentage. Colour: green only where none accepted unauthenticated requests; yellow below 5%; orange from 5% to below 25%; red at 25% and above.

Discovery Velocity

New AI endpoints discovered per day (last 14 days)

Shodan (port scan)

CT Logs (certificates)

AI vs Traditional CVE Analysis

Patch speed and severity distribution — last 2 years of NVD data

AI-Related CVEs

Total CVEs

4,563

Avg Days to Patch

109.9

Critical573 (12.6%)

High2,020 (44.3%)

Medium1,608 (35.2%)

Traditional CVEs

Total CVEs

141,054

Avg Days to Patch

138.9

Critical16,387 (11.6%)

High54,698 (38.8%)

Medium60,245 (42.7%)

Key Insight

AI CVEs are patched 21% faster than traditional software (109.9 vs 138.9 days), but have a 12.6% critical rate vs 11.6% for traditional — making them significantly more dangerous when they appear.

Real-world incidents

Six AI security incidents that defined the field

Each incident below is publicly reported and sourced. They map directly to the categories tracked above — when the chart shows an exposed vector database, this is what an exploited one looks like in practice.

Agentic AIJuly 2025

Replit AI agent wiped production database

1,200+ business records lost; fabricated test data to hide deletion

An autonomous Replit AI agent ignored an explicit code-freeze instruction, deleted a production database, then generated synthetic test data to mask the deletion. The incident was only discovered when the customer noticed missing real records — the AI's audit trail was a fiction.

Tracked under Agentic AI exposure + admission policy gap.

Source: Jason Lemkin / SaaStr ↗

Exposed EndpointJanuary 2025

DeepSeek API exposed 1M+ chat logs

1M+ user conversations + API keys publicly readable

Researchers at Wiz found a publicly-accessible DeepSeek ClickHouse database with no authentication. The exposure contained over a million chat logs, API keys, backend system metadata, and internal operational details. Time-to-discovery was under 60 minutes from initial probing.

Tracked under Exposed Endpoints + Vector DB / Database categories.

Source: Wiz Research ↗

Shadow AIApril 2023

Samsung engineers leaked source code to ChatGPT

Proprietary semiconductor designs ingested by training pipeline

Samsung Semiconductor engineers pasted internal source code into ChatGPT to debug a yield issue. OpenAI's training pipeline absorbed the data; competitor probing potentially surfaced fragments via prompt completion. Samsung banned all generative AI tools internally within 7 days.

Tracked under Shadow AI exposure (LLM Proxy category).

Source: Bloomberg ↗

Prompt InjectionFebruary 2024

Air Canada chatbot ordered to honor false discount

Tribunal-enforced contract liability for AI hallucination

Air Canada's customer-service chatbot fabricated a bereavement-discount policy that wasn't real. A British Columbia tribunal ruled the airline contractually liable for the chatbot's statement — establishing that AI outputs can create binding legal obligations. Damages: CAD $812 + costs.

Tracked under LLM Proxy + Prompt Injection exposure category.

Source: BC Civil Resolution Tribunal ↗

Supply Chain2024

Hugging Face supply chain — 100+ orgs compromised

Leaked API tokens enabled silent model-repo modifications

Researchers found over 1,500 stale API tokens leaked in Hugging Face Spaces, granting write access to model repositories at major AI labs (Meta, Microsoft, Google, others). A motivated attacker could have silently injected backdoors into widely-deployed models before discovery.

Tracked under Supply Chain / Model Registry exposure.

Source: Lasso Security ↗

Plugin Chain2024

ChatGPT plugin OAuth chain hijack (PoC)

Demonstrated exfiltration of chat history via plugin redirect

Salt Labs demonstrated that the ChatGPT plugin OAuth flow could be hijacked via a redirect-URI fixation. A malicious plugin could trigger an approval prompt impersonating a legitimate plugin, then exfiltrate the user's full chat history. OpenAI patched within 48 hours of disclosure.

Tracked under Plugin Chain + OWASP LLM07 (Insecure Plugin Design).

Source: Salt Labs ↗

Regulatory framework mapping

Each metric maps to enforceable controls

The numbers above aren't decorative — they tie directly to AI compliance frameworks that regulators are about to enforce. EU AI Act enforcement is scheduled in phases through 2027.

NIST AI-RMF

EU AI Act

ISO/IEC 42001

MITRE ATLAS

OWASP LLM Top 10

Metric tracked here	NIST AI-RMF	EU AI Act	ISO/IEC 42001	MITRE ATLAS	OWASP LLM Top 10
Exposed AI inference endpoints	MEASURE-2.7	Art. 15 (cybersecurity)	§ 8.4 (image registry)	AML.T0011	LLM01
Authentication gap on AI services	MANAGE-1.4	Art. 15(5) (cyber)	§ 8.2 (RBAC)	—	LLM07
Shadow AI workload discovery	MAP-1.1	Art. 9 (risk mgmt)	§ 7.4 (docs)	AML.T0011	LLM07
AI-related CVE tracking	MEASURE-2.7	Art. 15 (cybersecurity)	§ 8.4 (image policy)	AML.T0007	LLM06
Vector DB / model registry exposure	MANAGE-1.4	Art. 12 (logging)	§ 8.2 (RBAC)	AML.T0011	LLM06
AI workload audit logging	MEASURE-2.7	Art. 12 (logging)	§ 7.5 (info docs)	—	LLM08

EU AI Act enforcement timeline: watermarking + transparency obligations effective August 2026; high-risk AI provisions extended to December 2027 under the Digital Omnibus (a European Commission proposal from November 2025 — not yet adopted or legally binding).

What to do this quarter

11 actions grounded in this data

Concrete next-steps for security engineering, leadership, and compliance teams. Each one is verifiable, not aspirational — you can complete most of them in a single sprint.

🔧

Security Engineering

1
Inventory every KServe / Kubeflow / Ray / Seldon CRD monthly
kubectl get crd | grep -iE 'kserve|kubeflow|ray|seldon' — sign + commit to source of truth
2
Block AI-default ports at egress firewall unless explicitly allow-listed
Common targets: 6333 (Qdrant), 8080 (KServe), 19530 (Milvus), 5000 (MLflow), 11434 (Ollama)
3
Require authentication on every model registry and inference endpoint
Add admission policy (Kyverno / OPA Gatekeeper) blocking workloads without auth annotations
4
Enable Cloud Audit Logging on every AI namespace
EU AI Act Article 12 requires logged events for high-risk AI — get ahead of the deadline

🎯

Security Leadership

1
Map your full AI inventory before EU AI Act enforcement
Watermarking obligations live August 2026; high-risk provisions December 2027 (pending ratification)
2
Pre-build evidence pipelines for Articles 9, 15, 16, 17
80% of required evidence already exists in your K8s + cloud + KMS telemetry — wire it now, not under audit pressure
3
Audit each AI vendor against the 5 AI compliance frameworks
Most vendors disclose SOC 2 + ISO 27001 but NOT NIST AI-RMF, ISO 42001, or MITRE ATLAS posture — ask explicitly
4
Establish a continuous Shadow AI detection process
Subscribe Certificate Transparency logs + Shodan for your domains — most exposures show up in CT before they break in production

📋

Compliance Teams

1
Document AI risk classification per workload
EU AI Act Annex III categorizes high-risk AI uses — map your inventory to those categories now
2
Maintain ROPA entries for AI workloads under GDPR Article 30
AI workloads process personal data of EU citizens regardless of where your servers sit (Brussels Effect)
3
Track the bifurcated AI Act timeline
Don't conflate Aug 2026 watermarking with Dec 2027 high-risk — they're two milestones, two control sets

Methodology

How we measure the AI security gap

AI Service Discovery

Shodan sweeps every 12h, when Shodan query credits allow (Shodan data © Shodan) + crt.sh CT monitoring about once a minute. We detect Ollama, Jupyter, MLflow, Flowise, vector databases, LLM proxies, and 40+ signatures.

CVE Intelligence

CVEs from the NVD API, AI-related ones filtered using 25+ keywords: LLMs, transformers, embeddings, prompt injection, model poisoning.

Deep Verification

Confirmed Exposures count only rows our verifier checked (DNS, TLS and API probing) and found answering without authentication. AI Services Discovered and the regional adoption chart count every observation, checked or not.

Regional Attribution

Each row's country is as reported in Shodan data (© Shodan), mapped to a macro-region — NA, Europe, APAC, India, China, Middle East, Africa. Rows without one, including every Certificate Transparency row, are left out of the regional charts.

Beyond the public index

Monitor your own AI attack surface — not just the global trend.

This public index shows what's happening globally. EchelonGraph gives you the same visibility — scoped to your infrastructure, enriched with blast radius and remediation playbooks.

Talk to security engineering →Shadow AI Radar →Surface Scanner →

Seeing this scanner in your logs? It's us. Our Discovery Radars name themselves — like Googlebot — in the User-Agent of every HTTP request they send, for example

EchelonGraph-<Radar>/1.0 (+https://echelongraph.io/surface-scanner; opt-out https://echelongraph.io/responsible-disclosure; support@echelongraph.io)

or, from our radar prober, EchelonGraphBot/1.0 (+https://echelongraph.io/bot), and their HTTP requests to the hosts they check also carry a From: support@echelongraph.io header. Some checks are a single identified GET; others send several requests to one host. Confirming an MCP endpoint sends a POST asking the server which protocol versions it supports, a second POST with the older handshake only if the first is refused without a 2026-07-28 error, a DELETE to close any session a POST opened and, if a POST is refused with HTTP 401 or 403, up to two GETs of the server's OAuth protected-resource metadata on the same host; where neither POST finds an MCP endpoint, the older SSE transport's stream is requested with GET, only its first event is read, and the connection is closed. A server that answers the first POST with a DiscoverResult, or with an error the 2026-07-28 revision defines, opens no session and is sent no further POST, so it is not written to; if the POST is refused with HTTP 401 or 403, the metadata GETs above still follow. Confirming an exposed datastore needs a protocol-level exchange, and on Redis our client names itself so the connection is identifiable in your own CLIENT LIST. We never log in, submit credentials or exploit what we find. Who we are, exactly what each check sends, and how to opt out → A radar's HTTP requests to the host it checks also carry a signed receipt you can validate at /verify-scan.