The report
Censys reports that the number of internet-visible AI systems grew 63% over nine months. Its 2026 State of the Internet report also says 76% of the n8n instances whose versions it could identify are associated with a critical vulnerability. Both are observations about exposure and software identification, not a count of exploited agents or compromised organizations.
The two statistics answer different questions. The growth figure describes the visible infrastructure Censys classified as AI-related. The n8n percentage applies to a narrower, version-identifiable group of one workflow product. Applying 76% to every public n8n instance would change the denominator; treating it as the proportion of hosts that an attacker can actually control would change the measured event. The published Censys summary does not provide enough detail to independently reconstruct the product fingerprints, duplicate-host handling or complete version distribution.
Why exposure of an agent service deserves its own test
A publicly reachable agent or automation endpoint may have access to tools, credentials and data that make successful compromise consequential. Yet reachability alone is compatible with several very different states: a properly authenticated service, a service running an affected package without a reachable exploit, or one whose vulnerable route can be exercised remotely. The associated investigation keeps visibility, vulnerability matching and unauthorized effects separate.
A defensible follow-up would keep four counts apart: public endpoints discovered, endpoints with an identifiable version, endpoints whose versions fall in the reported affected range, and endpoints on which an authorized test reproduces the relevant unauthorized effect. Such testing also needs to distinguish an exposed interface from an agent actually capable of taking a privileged action. Censys's findings establish a reason to examine the boundary, not proof that the full visible population is already breached.