RESEARCH

AI Attack Surface Map

As of 2026-02, 12,269 of 175,108 Ollama servers on the public internet are exposed without authentication (~7.0%). On the Attack Surface Map, model endpoints currently lead published classes.

Ranked by published internet-wide zero-auth counts. Honeypot probe volume is attacker interest, not a population estimate. Classes marked collecting have no published population figure yet.

Raw JSON Census

  1. Model endpoints

    12,269 zero-auth

    Inference APIs that answer strangers — list models, chat, pull weights.

    LeakIX continuous scan · 2026-02 · honeypot probes (7d): 137

    Fix → Playground →

  2. MCP / tool transport

    collecting

    Model Context Protocol discovery, SSE, and tools catalogs without auth.

    honeypot probes (7d): 32

    Fix → Playground →

  3. Agent memory stores

    collecting

    Vector / RAG backends that may hold long-lived agent state (OWASP ASI06).

    OWASP ASI06

    honeypot probes (7d): 4

    Fix → Playground →

  4. Agent runtimes

    collecting

    Workflow and chatflow builders strangers can invoke or claim as admin.

    honeypot: collecting

    Fix → Playground →

  5. Notebooks & RCE surfaces

    collecting

    Interactive compute that becomes remote code execution when open.

    honeypot: collecting

    Fix → Playground →

  6. Prompt & trace backends

    collecting

    Observability that retains prompts, tools, and session state.

    honeypot: collecting

    Fix → Playground →

How to read this

1 class ranked from published census counts; 5 still collecting a population estimate. Snapshot 2026-02-28. Geo probe map (live hits): /map. Per-service census: /census.

Published third-party internet-wide observations, recorded by unauth.dev as a dated census snapshot. Observation windows and scanner methods differ. Services marked collecting have no published population estimate yet — consent-based sample counts from this site are labeled separately and are not population estimates.