Censys Counts 114,000 Exposed n8n Instances: the Self-Hosting Boom Has a Bill Coming Due

Somewhere in a datacenter in Virginia, or in a spare room in Berlin, an n8n instance is sitting on the open internet with its workflow editor unlocked and its credentials one request away. According to internet-intelligence firm Censys, it is one of nearly 114,000. Its fifth annual State of the Internet Report, released on October 14, names the popular workflow-automation platform the single most exposed AI product on the public internet, and its findings read as a census of the self-hosting boom's sharpest trade-off: convenience wins, until it costs you.

Censys's Advanced Research Collective (ARC) continuously scans the entire IPv4 space, and for this year's report it tracked how the exposed footprint of AI infrastructure changed over nine months. The headline number is growth: internet-facing AI tools grew 63 percent, reaching nearly 268,000 systems. That category is broader than chatbots. It includes the behind-the-scenes plumbing that connects AI models to data sources, applications, and user accounts: workflow engines, agent frameworks, model servers, and the APIs that tie them together. The self-hosted AI stack, in other words, is now large enough to be counted, and large enough to be attacked at scale.

The 63 percent surge

AI infrastructure is expanding far faster than the rest of the internet's exposed surface, and the geography is concentrated. Censys puts the United States at 62,687 exposed hosts, China at 42,511, and Germany at 31,222: three countries accounting for just over half of all exposed AI infrastructure. Behind n8n's nearly 114,000 exposed hosts sits OpenClaw, the personal AI agent assistant, at about 54,000. Both are products people self-host, both are products people point at the public internet, and both hand their operators powerful access to other systems.

The report also documents roughly 134,000 internet-exposed hosts running industrial control systems, with about 70 percent found on consumer and mobile networks, where identifying the owner is difficult. That figure belongs to a different threat conversation, but it underscores Censys's broader point: accidental exposure is the default failure mode of the modern internet, not a rare event. Self-hosters who assume their instance is invisible are betting against machinery that maps the entire internet on a continuous basis.

Accidental exposure is the default failure mode of the modern internet, not a rare event.

Why n8n tops the chart

n8n is open source, easy to install, and famously flexible: one Docker command gives you a visual canvas that can call APIs, move data between services, and now orchestrate AI agents with access to your credentials. That power is exactly what makes an exposed instance dangerous. A reachable n8n editor is not just a server you forgot about; it is a control panel wired into email accounts, databases, messaging apps, and cloud services, with the credentials for all of them stored inside.

Exposure would matter less if the software were consistently patched. Independent analysis of the report's figures puts the patch posture as the real problem: 76 percent of n8n instances with a detectable version were vulnerable to at least one recent critical flaw. For self-hosters this is the crux. The product you installed six months ago and never looked at again is not the product's current release. Automated scans do not need a zero-day; they need a version string and a search engine. Censys publishes its data, and attackers query it too.

Ports are not camouflage

One of the report's most practical findings punctures a beloved homelab habit. Among exposed HTTP and HTTPS services, 68 percent sat on non-standard ports; for SSH it was 34 percent. Running n8n on port 5679 instead of the default 5678 does not hide you from internet-wide scanners; it only annoys your team. Port scanners sweep everything, and Censys identifies services by what they answer, not by the number on the door. Security by obscurity was never a layer, but the data now quantifies how thin it is.

A hardening checklist for self-hosters

The good news is that the fixes are unglamorous and mostly free. Do not expose n8n's web UI to the public internet at all unless you have a concrete reason; put it behind a VPN or a private network and access it from there. If it must be reachable, place it behind a reverse proxy with TLS and real authentication, not just the default credentials, and enable multi-factor authentication where available. Update on a schedule rather than when something breaks: the 76 percent vulnerable figure is a reminder that patch debt compounds silently.

Separate the editor from the execution. If your workflows need webhooks from the outside world, expose only the webhook endpoints, and lock the admin interface down. Use a dedicated service account with minimal privileges instead of your personal credentials inside workflows, because credentials stored in an automation platform are credentials an attacker gets for free. Finally, check your own exposure the way Censys does: search for your public IP in a scan database, or simply scan yourself from the outside. If you can find your instance, everyone can.

The bill for the boom

The self-hosted AI wave grew up fast because the tools got good: n8n's agent workflows, local model servers, and one-click stacks made running your own AI infrastructure feel routine. Censys's numbers suggest the operational maturity has not kept pace with the adoption. Nearly 268,000 exposed systems in nine months is not a story about one vulnerable product; it is a story about a deployment pattern, the quick Docker run that never got a firewall review, repeated at internet scale.

That is the perspective worth keeping. Self-hosting remains one of the best ways to keep your data and your AI workflows under your own control. But control is not just ownership of the server; it is ownership of the maintenance burden that comes with it. The internet is being mapped continuously by people who will use the map. The question for every self-hoster is whether their instance is on that map by choice, or by accident.