{"snapshot_updated":"2026-08-03","methodology":"August 2026 census snapshot. Current per-service headlines use Shodan fingerprint index counts from the 2026-08 research pass where available (index match ≠ verified zero-auth). Ollama country/provider breakdowns are Shodan index facets for product:\"Ollama\" (Aug 2026), not LeakIX zero-auth shares. Older third-party windows remain in series. MCP and generic OpenAI-compatible stay collecting until a defensible fingerprint exists. Consent-based sample counts from this site are not population estimates.","cite":"As of 2026-08, 112,199 Ollama servers on the public internet are exposed without authentication. On the Attack Surface Map, model endpoints currently lead published classes. (sources: Shodan count · `product:\"Ollama\"` Aug 2026; Shodan count · `http.html:\"Ollama is running\" http.status:200` Aug 2026 - unauth.dev/attack-surface)","classes":[{"id":"model-endpoints","title":"Model endpoints","blurb":"Inference APIs that answer strangers - list models, chat, pull weights.","fix":"/fixes/ollama-exposed","playground":"/demo","owasp":null,"risk_class":null,"status":"published","zero_auth_total":112199,"published_services":1,"sources":["Shodan count · `http.html:\"Ollama is running\" http.status:200`"],"observed":["2026-08"],"probe_week":2416,"members":[{"id":"ollama","product":"Ollama","status":"published","zero_auth_count":112199,"href":"/census/ollama","fix_card_id":"ollama-exposed"},{"id":"vllm","product":"vLLM","status":"published","zero_auth_count":null,"href":"/census/vllm","fix_card_id":"vllm-exposed"}],"rank":1},{"id":"agent-memory","title":"Agent memory stores","blurb":"Vector / RAG backends that may hold long-lived agent state (OWASP ASI06).","fix":"/fixes/qdrant-exposed","playground":"/demo","owasp":"ASI06","risk_class":"agent-memory","status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":1174,"members":[{"id":"qdrant","product":"Qdrant","status":"published","zero_auth_count":null,"href":"/census/qdrant","fix_card_id":"qdrant-exposed"},{"id":"chroma","product":"Chroma","status":"published","zero_auth_count":null,"href":"/census/chroma","fix_card_id":"chroma-exposed"},{"id":"weaviate","product":"Weaviate","status":"published","zero_auth_count":null,"href":"/census/weaviate","fix_card_id":"weaviate-exposed"},{"id":"redis","product":"Redis","status":"published","zero_auth_count":null,"href":"/census/redis","fix_card_id":"redis-exposed"}],"rank":2},{"id":"mcp-tools","title":"MCP / tool transport","blurb":"Model Context Protocol discovery, SSE, and tools catalogs without auth.","fix":"/fixes/mcp-exposed","playground":"/demo","owasp":null,"risk_class":null,"status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":220,"members":[{"id":"mcp","product":"MCP servers","status":"collecting","zero_auth_count":null,"href":"/census/mcp","fix_card_id":"mcp-exposed"}],"rank":3},{"id":"agent-runtimes","title":"Agent runtimes","blurb":"Workflow and chatflow builders strangers can invoke or claim as admin.","fix":"/fixes/n8n-exposed","playground":"/demo","owasp":null,"risk_class":"agent-runtime","status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":0,"members":[{"id":"n8n","product":"n8n","status":"published","zero_auth_count":null,"href":"/census/n8n","fix_card_id":"n8n-exposed"},{"id":"flowise","product":"Flowise","status":"published","zero_auth_count":null,"href":"/census/flowise","fix_card_id":"flowise-exposed"},{"id":"langflow","product":"Langflow","status":"published","zero_auth_count":null,"href":"/census/langflow","fix_card_id":"langflow-exposed"},{"id":"langserve","product":"LangServe","status":"published","zero_auth_count":null,"href":"/census/langserve","fix_card_id":"langserve-exposed"},{"id":"dify","product":"Dify","status":"published","zero_auth_count":null,"href":"/census/dify","fix_card_id":"dify-exposed"},{"id":"openclaw","product":"OpenClaw","status":"published","zero_auth_count":null,"href":"/census/openclaw","fix_card_id":"openclaw-exposed"},{"id":"openhands","product":"OpenHands","status":"published","zero_auth_count":null,"href":"/census/openhands","fix_card_id":"openhands-exposed"},{"id":"autogen-studio","product":"AutoGen Studio","status":"published","zero_auth_count":null,"href":"/census/autogen-studio","fix_card_id":"autogen-studio-exposed"},{"id":"crewai","product":"CrewAI Studio","status":"published","zero_auth_count":null,"href":"/census/crewai","fix_card_id":"crewai-exposed"},{"id":"openwebui","product":"Open WebUI","status":"published","zero_auth_count":null,"href":"/census/openwebui","fix_card_id":"open-webui-exposed"}],"rank":4},{"id":"notebook-rce","title":"Notebooks & RCE surfaces","blurb":"Interactive compute that becomes remote code execution when open.","fix":"/fixes/jupyter-exposed","playground":"/demo","owasp":null,"risk_class":null,"status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":0,"members":[{"id":"jupyter","product":"Jupyter","status":"published","zero_auth_count":null,"href":"/census/jupyter","fix_card_id":"jupyter-exposed"}],"rank":5},{"id":"agent-traces","title":"Prompt & trace backends","blurb":"Observability that retains prompts, tools, and session state.","fix":"/fixes/langfuse-exposed","playground":"/demo","owasp":null,"risk_class":"agent-traces","status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":0,"members":[{"id":"langfuse","product":"Langfuse","status":"published","zero_auth_count":null,"href":"/census/langfuse","fix_card_id":"langfuse-exposed"}],"rank":6}],"published_class_count":1,"collecting_class_count":5,"note":"Ranked by published internet-wide zero-auth counts. Honeypot probe volume is attacker interest, not a population estimate. Classes marked collecting have no published population figure yet."}