Hook
The Censys scan ran for nine months. What it returned wasn't a breach report. It was a confession.
Exposed AI infrastructure — live model endpoints, unauthenticated vector databases, MLOps control planes, GPU cluster management interfaces — grew 63% in that window. Not 6%. Sixty-three. Nine months of "deploy fast, authenticate later" culture, all of it sitting on public IP space, waiting for the first scanner with a cron job and a grudge.
Most of the coverage buried the lede under the word "exposed." Here's what they missed: this is a crypto story wearing a new coat. The exact playbook that turned DeFi summer into DeFi winter — ship first, secure never, apologize in a Discord thread — has been copy-pasted into the machine-learning stack. The people who watched it happen in 2020 are watching it happen again. Only this time the collateral isn't a governance token. It's training data, model weights, and somebody else's rented H100s.
I've run this movie before. In 2020 I live-blogged a flash-loan attack by transaction hash while the protocol's Telegram went dark. The pattern never changes: velocity beats rigor, until the invoice arrives.
Context: what "exposed AI infrastructure" actually means
Let me define the target before I aim at it.
A modern AI system is not a model. A model is one file — a big one, but a file. The system is the scaffold around it, and the scaffold is where everything leaks.
There are four load-bearing pieces.
The inference endpoints: the REST or gRPC surfaces where your application calls the model. The vector databases — Milvus, Weaviate, Qdrant, and the managed lookalikes — which hold embeddings that are, in practice, a lossy but recoverable compression of your source data. The MLOps control planes: MLflow, Kubeflow, Airflow, the orchestration that governs training runs and the model registry. And the compute layer: GPU cluster management, often NVIDIA DCGM or a scheduler dashboard, plus the Kubernetes that binds the whole thing together.
Every one of those ships with a default. And every default was written for a trusted network.
The vector database defaults to no authentication because "you'll put it behind the VPC." The MLOps server defaults to no auth because "it's an internal tool." The GPU dashboard defaults to read-only because "nobody's going to find the port." Then a startup wires it to a public load balancer to demo for an investor, forgets to unwire it, and the port is found.
Why now? Because the deployment curve is vertical. Every company that raised in the last eighteen months promised "AI features" on a quarterly call, and the fastest path to shipping is to bind a service to 0.0.0.0 and pray. Censys is just the camera that caught it.
And here's the crypto bridge the report doesn't draw but the data begs for. The last cohort to build infrastructure this fast, this publicly, this carelessly was Web3. DePIN GPU networks — Render, Akash, io.net, and a long tail of compute marketplaces — have spent two years wiring heterogeneous GPUs into public coordination layers. AI agent frameworks — the Eliza and GOAT swarm and their clones — have spent the last year handing autonomous software wallets and API keys. Both categories are, definitionally, exposed infrastructure. Both grew during exactly the window Censys measured.
So when I say this is a crypto story, I don't mean crypto caused it. I mean crypto already ran the experiment. We have the results. We know how it ends.
Core: the four exposure classes, and what they cost
Now the technical meat. I want to walk each exposure class the way I'd walk a post-mortem — by what breaks, in what order, and who eats the loss.
The inference endpoint. This is the front door, and it's usually unlocked.
An exposed inference endpoint is not just a compute leak. It's a model-extraction surface. If an attacker can query your endpoint at volume, they can reconstruct behavior, harvest outputs for distillation, and — with enough queries — approximate a student model that does 90% of your job for free. This isn't hypothetical. Model stealing via query access is a well-documented class. The attacker's cost is API calls. Your cost is your moat.
In crypto terms, think of it as front-running your own alpha. You spent $40M on training compute. Somebody else spends $4,000 on inference calls and walks away with a distilled copy. The asymmetry is brutal because the endpoint never asked who was calling.
I've watched this exact reflex in crypto. Back in 2021, a DeFi protocol I was covering left its price oracle endpoint wide open — anyone could poll it, reverse-engineer the update cadence, and time liquidations around it. No exploit contract. No flash loan. Just an open door and a patient observer. The endpoint is the oracle now, and the oracle is still naked.
The vector database. This is the one that should keep CISOs awake.
A vector DB looks like a search index. It isn't. It's a semantic fingerprint of everything you ever embedded — customer support logs, internal docs, PII, source code, whatever your retrieval-augmented pipeline ingested. No auth means no logging of who pulled what. An attacker doesn't need to exfiltrate a schema. They query by similarity and walk out with your knowledge base in ranked order.
I've audited pipelines where the embeddings contained verbatim customer emails. The team thought the vector store was "derived data." It was the data. Just in a different coordinate system. And because similarity search returns neighbors, one query can surface hundreds of related records — a data-leak amplifier with a friendly UI and no rate limit.
The MLOps control plane. This is the supply-chain vector, and it's the scariest because it's quiet.
An exposed MLflow or Kubeflow isn't just a leak — it's write access to your training pipeline. Inject a poisoned checkpoint. Flip a preprocessing step. Alter a model registry tag. Every downstream deployment inherits the corruption. You don't get a breach alert. You get a model that works fine in testing and misbehaves in production three weeks later, when nobody's connecting the dots.
This is the crypto bridge nobody wants to name. It's the same structure as a compromised build pipeline that mints a malicious contract version — the exploit isn't at the edge, it's upstream. And it propagates to every user who trusts the artifact. The Tornado Cash sanctions taught us that infrastructure can be weaponized at the layer people don't look at. Model poisoning is the AI version of that same lesson, minus the court order.
The GPU cluster interface. This is the one that turns into a headline.
An exposed GPU management plane is rentable compute with someone else's invoice attached. Hijack a cluster and you get three things at once: free training cycles, a DDoS cannon, and a crypto-mining rig. The last one closes the loop — the stolen compute gets monetized on the same public chains that the compute marketplaces settle on. The attacker doesn't even need to launder. The payout is already native.
And here's where I'll make a claim the report won't. The 63% number is almost certainly undercounted, because it counts only what a passive scanner can see. It cannot see misconfigured IAM policies that grant wide access to a correctly-firewalled service. It cannot see API keys pasted into a public repo that unlock a private endpoint. It cannot see the developer laptop running an SSH tunnel that quietly exposes a staging cluster. The visible exposure is the floor, not the ceiling.
The subsidy problem, restated
Here's where crypto's scars become useful.
In DeFi, liquidity mining was never yield. It was a subsidy dressed as yield — a project paying out tokens to rent TVL it couldn't retain. Pull the incentive, watch the TVL evaporate. Everyone knew it. Everyone pretended not to, because the number went up and the number was the product.
Apply the same lens to AI infrastructure. The "move fast" culture is a subsidy too. Companies are subsidizing deployment speed by borrowing against future security debt. It works until it doesn't. The interest rate on that debt is set by the first attacker who finds the endpoint, and the payment is data, compute, or reputation.
DePIN compute networks run the identical play. They subsidize supply — free GPU hours, token rewards for uptime — to rent utilization they haven't earned. The coordination is real and the tech is often clever. But the security posture is an afterthought bolted on when a validator first gets exploited. I've watched compute marketplaces list nodes running exposed management APIs as a feature, not a bug, because "open" is the brand and "open" sells.
DeFi was not a bug; it was a feature of chaos. The same sentence fits the AI stack in 2026, and it should scare anyone who thinks the word "open" implies "safe."
The Layer2 parallel nobody's drawing
I want to zoom out one more level, because there's a structural parallel that explains why this gets worse before it gets better.
In 2024, the Dencun upgrade gave rollups cheap blob data. Fees collapsed. Everyone celebrated. I wrote then — and I'll write again — that blob space would saturate within two years, and then rollup gas fees double again. The cheap-data window isn't a permanent state. It's a subsidy, and subsidies end.
The AI stack is living in its own Dencun moment. Cheap GPUs, cheap storage, cheap API calls — the cost of deploying an AI service has collapsed, so everyone deploys. But the security cost hasn't collapsed. It's been deferred. When the deferral ends — when a high-profile breach forces real spending on auth, segmentation, and provenance — the cost of running AI infrastructure steps up, and a lot of marginal projects die.
The rollup that survives saturation is the one that built for the expensive future. The AI startup that survives the security reckoning is the one that didn't treat authentication as a post-launch ticket. Same lesson, different stack. And the crypto natives who've already lived through one subsidy expiry should be the first to see this one coming.
The regulatory clock is already running
The EU AI Act's high-risk provisions are phasing in through 2026. It doesn't have a clause that says "authenticate your vector database." But it does have a clause that says high-risk systems must demonstrate appropriate technical robustness and cybersecurity. Regulators will read that clause the way they read MiCA — broadly, and after the fact. The first enforcement action won't be about a model. It'll be about an exposed endpoint that led to a leak, and the fine will be calculated on revenue, not on the size of the misconfiguration.
This is the DeFi playbook again. The SEC didn't regulate DeFi; it regulated the visible interfaces and sued the rest. The AI stack will get the same treatment — regulators will hit what they can see, and the actual risk will keep compounding in the layers they can't. The MLOps pipeline is the new smart contract: composable, trusted, and invisible to the people writing the rules.
The payments angle — why emerging markets matter here
One more piece, and it's the piece Western coverage always drops.
The fastest-growing deployment of AI infrastructure is not in San Francisco. It's in Lagos, Bangalore, São Paulo, and Jakarta — places where the local currency is losing value and the fastest path to a working product is a rented GPU and an open API. I've watched this from Lagos since 2017. The same inflation that pushes people into stablecoins pushes founders into cheap, self-hosted AI.
That's a feature, not a bug. But it's also why the exposure curve is steep in exactly the places with the weakest security tooling. The real driver of crypto payments in developing markets was never ideology. It was survival. The real driver of self-hosted AI in those same markets is also survival — and survival doesn't budget for a security audit.
So when Censys counts exposed infrastructure, a disproportionate slice of that count is probably a founder in an emerging market doing the best they can with a credit card and a deadline. That doesn't excuse the misconfiguration. It just tells you where the fix has to land — defaults that are safe without being expensive, because the people who need them most can't afford a vendor.
Contrarian: the exposure isn't the failure — the response will be
Everybody in my feed read the Censys number as a crisis. I read it as a stress test, and I think the real damage comes after, not before.
Here's the counter-intuitive angle. The 63% growth in exposed infrastructure is, in a strange way, evidence of a functioning market. It means a lot of people are building. The alternative — flat exposure — would mean nobody's shipping AI. Exposure and innovation are the same curve viewed from two angles. The danger isn't that infrastructure is exposed. The danger is what the industry does next: overcorrect into a compliance theater that locks down the wrong layer.
Watch for three things.
First, security vendors will rebrand every existing attack-surface-management tool as "AI security" and sell it to boards that don't know a vector DB from a VPN. Some of it will help. Most of it will be a dashboard. The actual fix — authentication on by default, network segmentation, key rotation — is unglamorous and won't get a keynote.
Second, cloud providers will use this to deepen lock-in. "Default-secure AI" becomes a walled garden where the safety is real and the exit cost is realer. The open, self-hosted AI stack — the crypto-native one — will get framed as the dangerous choice, even though the dangerous choice is misconfiguration, not self-hosting.
Third, and this is the one that matters for crypto: regulators will reach for the AI stack the same way they reached for DeFi, and they'll miss the same way. They'll regulate the visible surface — the endpoint, the API — and ignore the coordination layer where the actual risk compounds.
Here's the uncomfortable part. The crypto industry is uniquely positioned to fix this, and uniquely positioned to ignore it. We invented public-by-default infrastructure. We know, in our bones, that "exposed" and "permissionless" are one configuration flag apart. That's a genuine advantage. But we also have a cultural allergy to closing doors, because closed doors killed our composability dreams once already. So we'll wave the flag, ship the same misconfigurations into the AI stack, and act surprised.
In the void, we found our value in the noise. That was a good line when the noise was price discovery. It's a worse line when the noise is a leaked training set.
What actually fixes this
Let me be concrete, because vague warnings are how we got here.
The fix is not a product. It's three defaults, applied at the deployment layer where humans are lazy.
Default-deny network posture for every AI service. If a service doesn't need public ingress, it doesn't get public ingress — not "shouldn't," doesn't. This single change kills the majority of the Censys surface.
Authentication and authorization on every component, including the ones labeled "internal." The word internal is a lie you tell yourself until the port scan. Vector DBs, MLOps servers, and GPU dashboards all ship auth-off. Turn it on before the first commit, not after the first incident.
Provenance for every artifact. Signed model checkpoints, signed training configs, a registry that refuses unsigned artifacts. This is the supply-chain answer, and it's the one crypto should own, because we already have the primitives — signing, verification, transparency logs. We just don't apply them to our own ML pipelines.
None of this is exotic. All of it is boring. Boring is the point. The industry doesn't have a knowledge problem; it has a priority problem, and priorities are set by whoever screams loudest. So far, the loudest voices are selling scanners. The quiet ones are the people who'd actually fix it.
Takeaway
So here's what I'm watching, and what you should be watching.
Watch whether the next Censys-style report breaks the number down by category — endpoints vs. vector stores vs. MLOps — because that tells you where the pain lands first. Watch whether any cloud provider ships a genuinely default-secure AI template, or just a marketing page. Watch whether the crypto AI stack — DePIN compute, agent frameworks — gets named in the next exposure report, because if it does, the "open by default" brand is about to collide with reality.
And watch the first real incident. Not a scan. Not a warning. An actual hijacked training run, or a leaked embedding store with a name attached. That's the moment the subsidy comes due, and the industry discovers that the bill for speed was always going to be paid — the only question was by whom.
The story's in the pulse. Right now the pulse says build fast. The question is how many more pulses until it says lock the door.