The race to embed autonomous AI agents into enterprise workflows is vastly outpacing the cybersecurity capacity required to protect them, leaving tens of thousands of corporate systems dangerously exposed to the public internet.

Across Australia and Aotearoa, businesses have embraced the productivity promises of generative AI with gold-rush enthusiasm. From customer service to software development and finance operations, organisations are rapidly connecting AI agents directly to their email servers, CRM platforms, and proprietary corporate databases. However, regional experts are warning that this aggressive deployment strategy is running headlong into a severe cybersecurity skills shortage.

Mark Lukie, APAC Director of Solutions Architects for Barracuda, notes that businesses are handing machines unprecedented access and autonomy, while the teams tasked with securing them are struggling to keep up. The result is a highly dangerous combination of elevated privileges and inadequate oversight.

Now, stark international data has quantified just how severe this blind spot has become. According to the newly released 2026 State of the Internet Report by attack surface management firm Censys, the volume of AI-related infrastructure exposed to the open internet has surged by 63 per cent over the past nine months.

Internet intelligence mappers identified more than 294,000 distinct public IP addresses exposing 43 different artificial intelligence and large language model (LLM) tools. The findings suggest that enterprise IT teams are deploying experimental AI tooling far quicker than they can implement basic access controls or patch known vulnerabilities.

The security gap is most pronounced in some of the fastest-growing AI orchestration platforms. Censys highlighted Langflow, a popular interface for building LLM applications, which saw its exposed deployments grow by 169 per cent this year. The platform has been tied to 18 reported Common Vulnerabilities and Exposures (CVEs). Of those, 14 carry a critical CVSS score above 8.0, and four are actively listed in known exploited vulnerability catalogues.

Similarly, LiteLLM—an enterprise proxy tool used to manage API calls to various AI models—experienced 97 per cent growth in exposed instances. It is currently affected by a pre-authentication SQL injection vulnerability (CVE-2026-42208) that is being actively exploited in the wild.

For enterprises in the Asia-Pacific region, the convergence of these two trends is alarming. When a business integrates an AI agent into its internal network to read emails or query a financial database, that agent requires high-level privileges to function. If the underlying framework governing that agent is left exposed to the public internet with an unpatched SQL injection flaw, malicious actors can hijack the agent's permissions to extract sensitive corporate data or pivot laterally through the network.

As the AI gold rush continues, the imperative for local CIOs and security teams is clear: the operational rewards of autonomous agents cannot justify the deployment of unvetted, internet-facing infrastructure. The tools may be new, but the fundamental rules of network hygiene remain entirely unforgiving.

Sources

AI disclosure: Automated systems assisted with research and drafting. Gemini independently peer-reviewed this article before publication. Sources are linked for verification.