{"snapshot_updated":"2026-02-28","methodology":"Published third-party internet-wide observations, recorded by unauth.dev as a dated census snapshot. Observation windows and scanner methods differ. Services marked collecting have no published population estimate yet — consent-based sample counts from this site are labeled separately and are not population estimates.","cite":"As of 2026-02, 12,269 of 175,108 Ollama servers on the public internet are exposed without authentication (~7.0%). On the Attack Surface Map, model endpoints currently lead published classes.","classes":[{"id":"model-endpoints","title":"Model endpoints","blurb":"Inference APIs that answer strangers — list models, chat, pull weights.","fix":"/fixes/ollama-exposed","playground":"/playground#s=ollama,vllm","owasp":null,"risk_class":null,"status":"published","zero_auth_total":12269,"published_services":1,"sources":["LeakIX continuous scan"],"observed":["2026-02"],"probe_week":137,"members":[{"id":"ollama","product":"Ollama","status":"published","zero_auth_count":12269,"href":"/census/ollama","fix_card_id":"ollama-exposed"},{"id":"vllm","product":"vLLM","status":"collecting","zero_auth_count":null,"href":"/census/vllm","fix_card_id":"vllm-exposed"}],"rank":1},{"id":"mcp-tools","title":"MCP / tool transport","blurb":"Model Context Protocol discovery, SSE, and tools catalogs without auth.","fix":"/fixes/mcp-exposed","playground":"/playground#s=mcp,ollama","owasp":null,"risk_class":null,"status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":32,"members":[{"id":"mcp","product":"MCP servers","status":"collecting","zero_auth_count":null,"href":"/census/mcp","fix_card_id":"mcp-exposed"}],"rank":2},{"id":"agent-memory","title":"Agent memory stores","blurb":"Vector / RAG backends that may hold long-lived agent state (OWASP ASI06).","fix":"/fixes/qdrant-exposed","playground":"/playground#s=qdrant,chroma,ollama","owasp":"ASI06","risk_class":"agent-memory","status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":4,"members":[{"id":"qdrant","product":"Qdrant","status":"collecting","zero_auth_count":null,"href":"/census/qdrant","fix_card_id":"qdrant-exposed"},{"id":"chroma","product":"Chroma","status":"collecting","zero_auth_count":null,"href":"/census/chroma","fix_card_id":"chroma-exposed"},{"id":"weaviate","product":"Weaviate","status":"collecting","zero_auth_count":null,"href":"/census/weaviate","fix_card_id":"weaviate-exposed"}],"rank":3},{"id":"agent-runtimes","title":"Agent runtimes","blurb":"Workflow and chatflow builders strangers can invoke or claim as admin.","fix":"/fixes/n8n-exposed","playground":"/playground#s=n8n,flowise,dify","owasp":null,"risk_class":"agent-runtime","status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":0,"members":[{"id":"n8n","product":"n8n","status":"collecting","zero_auth_count":null,"href":"/census/n8n","fix_card_id":"n8n-exposed"},{"id":"flowise","product":"Flowise","status":"collecting","zero_auth_count":null,"href":"/census/flowise","fix_card_id":"flowise-exposed"},{"id":"langserve","product":"LangServe","status":"collecting","zero_auth_count":null,"href":"/census/langserve","fix_card_id":"langserve-exposed"},{"id":"dify","product":"Dify","status":"collecting","zero_auth_count":null,"href":"/census/dify","fix_card_id":"dify-exposed"},{"id":"openclaw","product":"OpenClaw","status":"collecting","zero_auth_count":null,"href":"/census/openclaw","fix_card_id":"openclaw-exposed"},{"id":"autogen-studio","product":"AutoGen Studio","status":"collecting","zero_auth_count":null,"href":"/census/autogen-studio","fix_card_id":"autogen-studio-exposed"},{"id":"crewai","product":"CrewAI Studio","status":"collecting","zero_auth_count":null,"href":"/census/crewai","fix_card_id":"crewai-exposed"},{"id":"openwebui","product":"Open WebUI","status":"collecting","zero_auth_count":null,"href":"/census/openwebui","fix_card_id":"open-webui-exposed"}],"rank":4},{"id":"notebook-rce","title":"Notebooks & RCE surfaces","blurb":"Interactive compute that becomes remote code execution when open.","fix":"/fixes/jupyter-exposed","playground":"/playground#s=jupyter,ollama","owasp":null,"risk_class":null,"status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":0,"members":[{"id":"jupyter","product":"Jupyter","status":"collecting","zero_auth_count":null,"href":"/census/jupyter","fix_card_id":"jupyter-exposed"}],"rank":5},{"id":"agent-traces","title":"Prompt & trace backends","blurb":"Observability that retains prompts, tools, and session state.","fix":"/fixes/langfuse-exposed","playground":"/playground#s=langfuse,ollama","owasp":null,"risk_class":"agent-traces","status":"collecting","zero_auth_total":null,"published_services":0,"sources":[],"observed":[],"probe_week":0,"members":[{"id":"langfuse","product":"Langfuse","status":"collecting","zero_auth_count":null,"href":"/census/langfuse","fix_card_id":"langfuse-exposed"}],"rank":6}],"published_class_count":1,"collecting_class_count":5,"note":"Ranked by published internet-wide zero-auth counts. Honeypot probe volume is attacker interest, not a population estimate. Classes marked collecting have no published population figure yet."}