2026-08-10 · ~8 min read

112,199 Ollamas answer anyone. That's the boring part.

This week I pulled fresh numbers on exposed AI infrastructure. The headline is that as of August 2026, 112,199 Ollama servers answered an unauthenticated request from Shodan's crawler with the Ollama banner and a 200. Shodan never logs in, so every one of those is verified zero-auth at crawl time. That is nine times the figure everyone has been quoting since February.

Big number, fine. It is not the interesting part. Three smaller findings from the same week are, because each of them says something about how bad we are at even seeing this surface.

1. The default port is where the minority lives

Only 15,879 of those Ollamas answer on :11434, the documented port. The other 86% sit on random ports behind proxies and port maps. Same pattern for Ray: about 159,000 dashboards in Shodan's index, almost none on :8265.

Think about what that means for how people check exposure. Every "is my Ollama safe" guide tells you to look at 11434. Most scanners probe well-known ports and move on. The careless show up on the default port. Everyone else, the people who proxied it through nginx on :8443 because they were being careful, is invisible to that check and reachable by every bot on earth. Bots do not read the docs for port numbers.

2. MCP is the surface internet scanners cannot see

MCP servers are how agents call tools now, so I tried to count them. First attempt, searching Shodan for the Mcp-Session-Id header: 88,914 hosts. Looked like a huge story. Then I sampled them. DVRs. Ivanti VPNs. Bitcoin miners. Cable boxes. Appliances that happen to use the same header string. Not MCP servers.

The honest figure, from hosts that actually negotiate MCP protocol versions, is about 1,181. And the SSE-transport MCP servers do not show up in internet indexes at all, because Shodan does not record streaming responses. So the real count is unknowable from the outside.

Here is the part that should worry you. While the indexes are blind, my honeypot's MCP decoy had its busiest week ever: 140 probes in a single day, including a user agent called CryptoHunter-Vite-2026/1.0. Attackers are finding a surface that the measurement infrastructure cannot count. They are not smarter than Shodan. They just try the ports anyway.

I am showing you the 89k to 1.2k collapse on purpose. Substring matching said 89 thousand. Sampling said mostly set-top boxes. This is why every number I publish carries the query and the method next to it, and why my own checkers require two independent signals before they name a product. You should expect the same from anyone selling you a count.

3. Nobody reviews the workflows you download

Last one, and it is the one I did not expect. I built a small static scanner for AI workflow templates (n8n, Dify, Flowise files) and ran it on 156 random community workflows from the n8n marketplace.

74.4% flagged. Not because they are malicious. Almost none are. The pattern is undeclared dependencies: a template that reads your Google Sheet and then posts to an AI gateway you have never heard of. The top outbound domains in the sample were queue.fal.run (52 templates), backend.blotato.com (44), api.groq.com (28), api.upload-post.com (28), api.apify.com (24). One in three templates has the full shape: reads data, sends data somewhere unvetted.

To n8n's credit, zero templates in the sample had credentials embedded. They strip them on export. The problem is not leaked keys. It is that installing a community workflow today means trusting every domain inside it, and no marketplace checks those for you. I checked one of the flagged ones by hand to make sure I was not crying wolf: it was a normal template doing exactly what it advertised, through four third-party gateways the description never mentioned.

What any of this is for

All three findings sit on top of the same instruments: a scanner that only sends GETs, a honeypot that logs what bots ask for, and a habit of publishing the method with the number. This week I also started recording findings like these as a public advisory dataset at /advisories, CC-BY, one stable ID per record, because the deployment states above (unclaimed setup pages, no-auth defaults, exposed tool transports) are not CVEs, so nobody else writes them down.

If you want to check your own stuff: the scanner is free, the demo shows what a report looks like in ten seconds, and the template scanner ships in the same package. Everything I measured here, you can re-measure. That is the point of publishing the queries.