LH042 sources
Every page fetched for this study on 8 November 2026 (UTC), with the read log's time and HTTP status. Bodies are in data/<directory>/<n>.body, with IPv4 addresses, one quoted key and email addresses withheld as data/SCREENING.md records; sha256_as_fetched in each readlog.csv is the hash of the bytes received. Search results that were not opened are in searchlog.md. The design read of Anthropic's post (WebFetch extract, about 19:08 UTC) is described there; it supplies no count.
| file | source | URL | published | observation window | read (UTC) | HTTP | use |
|---|---|---|---|---|---|---|---|
| dash-2026-11-08T1909Z/001 | SecurityScorecard DECLAWED page | https://declawed.io/ | live | 2026-11-08T19:09:17Z | 200 | method text only; counts load from /api/, disallowed (R10); body withheld 9 November 2026 (use=reference), hash and quotations in data/dash-2026-11-08T1909Z/001.withheld.json | |
| dash-2026-11-08T1909Z/002 | https://declawed.io/api/stats | 2026-11-08T19:09:20Z | not fetched: robots.txt disallows | ||||
| dash-2026-11-08T1909Z/003 | Shadowserver dashboard | https://dashboard.shadowserver.org/ | 2026-11-08T19:09:20Z | URLError: <urlopen error [Errno 104] Con | unread: connection reset | ||
| round1-2026-11-08/001 | Xu, Li, Qiu, Sun, arXiv 2609.07115 abstract | https://arxiv.org/abs/2609.07115 | submitted 2026-09-07 | 2025-02-14 to 2026-02-13 | 2026-11-08T19:11:09Z | 200 | admitted (C05) |
| round1-2026-11-08/002 | the same paper, HTML (IMC 2026) | https://arxiv.org/html/2609.07115 | 2026-09-07 | 2025-02-14 to 2026-02-13 | 2026-11-08T19:11:11Z | 200 | admitted (C01 to C04); its aggregate data release is described but no location is given in the HTML, so the daily series was not found |
| round1-2026-11-08/003 | SentinelLABS, "Silent Brothers" (with Censys) | https://www.sentinelone.com/labs/silent-brothers-ollama-hosts-form-anonymous-ai-network-beyond-platform-guardrails/ | January 2026 (relayed) | 293 days (relayed) | 2026-11-08T19:11:14Z | 429 | unread: HTTP 429; not retried |
| round1-2026-11-08/004 | Censys ARC, "Ollama Drama" | https://censys.com/blog/ollama-drama-investigating-the-prevalence-of-ollama-open-instances-with-censys/ | 2025-09-24 | single-day snapshot | 2026-11-08T19:11:16Z | 200 | admitted (C06, C07) |
| round1-2026-11-08/005 | LeakIX, "12,000 Ollama Instances Exposed" | https://blog.leakix.net/2026/02/ollama-exposed/ | 2026-02-23 | "right now" | 2026-11-08T19:11:18Z | 200 | admitted (C10) |
| round1-2026-11-08/006 | Cisco, "Detecting Exposed LLM Servers" | https://blogs.cisco.com/security/detecting-exposed-llm-servers-shodan-case-study-on-ollama | 2025-09-01 | not stated | 2026-11-08T19:11:22Z | 200 | admitted (C08) |
| round1-2026-11-08/007 | TrendAI (Trend Micro), State of AI Security report | https://www.trendmicro.com/vinfo/us/security/news/threat-landscape/fault-lines-in-the-ai-ecosystem-trendai-state-of-ai-security-report | 2026-03-03 | September to mid-December 2025 | 2026-11-08T19:11:26Z | 200 | admitted (C11, C12, C33); MCP 1,467 not admitted (R11) |
| round1-2026-11-08/008 | CyberDesserts, AI infrastructure scanning research | https://blog.cyberdesserts.com/ai-infrastructure-scanning-research/ | 2026-05-14 (updated July 2026) | queries of 2026-05-11 | 2026-11-08T19:11:29Z | 200 | admitted (C17 to C19, C30) |
| round1-2026-11-08/009 | ThreatFrontier, Ollama CVE-2026-108836 article | https://threatfrontier.com/articles/ollama-pull-api-ssrf-cve-2026-108836-exposed-servers-public-exploit | 2026-10-13 | relays OpenA2A | 2026-11-08T19:11:31Z | 200 | secondary; led to OpenA2A |
| round1-2026-11-08/010 | Malware Patrol, "Over 14,000 Ollama Instances" | https://www.malwarepatrol.net/over-14000-ollama-instances-exposed-to-the-internet-serious-security-implications/ | 2025-06-20 | not stated | 2026-11-08T19:11:34Z | 200 | admitted (C09) |
| round1-2026-11-08/011 | CSA research note, exposed AI infrastructure | https://labs.cloudsecurityalliance.org/research/csa-research-note-exposed-ai-infrastructure-selfhosted-secur/ | 2026-05-07 | relays Intruder | 2026-11-08T19:11:39Z | 200 | secondary; led to Intruder |
| round1-2026-11-08/012 | arXiv 2505.02502 abstract | https://arxiv.org/abs/2505.02502 | v1 2025-05-05, v2 2025-08-26 | as of 2025-04-20 | 2026-11-08T19:11:41Z | 200 | context; counts taken from the HTML (round 2) |
| round1-2026-11-08/013 | UpGuard, Ollama instances | https://www.upguard.com/blog/understanding-and-securing-exposed-ollama-instances | 2025-03-19 | 2026-11-08T19:11:43Z | 200 | no count | |
| round1-2026-11-08/014 | LeakIX, "What We Found Scanning the Internet in 2026" | https://blog.leakix.net/2026/02/appscan-coverage-2026/ | 2026-02-09 | 2026-11-08T19:11:46Z | 200 | no AI-service count | |
| round1-2026-11-08/015 | insecurestack, "Ollama Servers Through the Loupe" | https://insecurestack.substack.com/p/eus-exposed-ai-infrastructure | 2026-04-07 | April 2026 | 2026-11-08T19:11:49Z | 200 | admitted (C14) |
| round1-2026-11-08/016 | Censys ARC, "OpenClaw in the Wild" | https://censys.com/blog/openclaw-in-the-wild-mapping-the-public-exposure-of-a-viral-ai-assistant/ | 2026-01-31 | as of 2026-01-31 | 2026-11-08T19:11:51Z | 200 | admitted (C37); R12 |
| round1-2026-11-08/017 | SecurityScorecard, "Beyond the Hype" | https://securityscorecard.com/blog/beyond-the-hype-moltbots-real-risk-is-exposed-infrastructure-not-ai-superintelligence/ | 2026-02-09, modified 2026-03-20 | 24 hours to publication; live text undated | 2026-11-08T19:11:53Z | 200 | admitted (C38 to C40) |
| round1-2026-11-08/018 | SecurityScorecard, "How Exposed OpenClaw Deployments..." | https://securityscorecard.com/blog/how-exposed-openclaw-deployments-turn-agentic-ai-into-an-attack-surface/ | 2026-02-11 | 2026-11-08T19:11:56Z | 200 | no further count | |
| round1-2026-11-08/019 | SecurityScorecard, "What Are the Real Security Risks..." | https://securityscorecard.com/blog/what-are-the-real-security-risks-of-agentic-ai-and-openclaw/ | 2026-02-17 | 2026-11-08T19:11:58Z | 200 | no count | |
| round1-2026-11-08/020 | Hunt.io, "Hunting OpenClaw Exposures" | https://hunt.io/blog/cve-2026-25253-openclaw-ai-agent-exposure | 2026-02-03 | not stated | 2026-11-08T19:12:01Z | 200 | admitted (C41) |
| round1-2026-11-08/021 | CyberDesserts, "OpenClaw exposure numbers explained" | https://blog.cyberdesserts.com/openclaw-exposure-numbers-explained/ | 2026-03-31 | query of 2026-03-31 | 2026-11-08T19:12:04Z | 200 | admitted (C42); relays SecurityScorecard 135,000 (R02) |
| round1-2026-11-08/022 | Censys, "5 Key Takeaways" (State of the Internet 2026) | https://censys.com/blog/state-of-the-internet-report-2026 | 2026-10-14 | October 2025 to July 2026 | 2026-11-08T19:12:06Z | 200 | admitted (C36); growth stated only as a percentage |
| round1-2026-11-08/023 | Censys, report landing page | https://censys.com/2026-state-of-the-internet-report | 2026-11-08T19:12:09Z | 200 | the report sits behind a form; unread | ||
| round1-2026-11-08/024 | Penligent, "Over 220,000 OpenClaw instances" | https://www.penligent.ai/hackinglabs/over-220000-openclaw-instances-exposed-to-the-internet-why-agent-runtimes-go-naked-at-scale/ | 2026-10-08 | relays | 2026-11-08T19:12:12Z | 200 | secondary (R02 to R04) |
| round1-2026-11-08/025 | CSA research note, OpenClaw Claw Chain | https://labs.cloudsecurityalliance.org/research/csa-research-note-openclaw-claw-chain-cve-20260517-csa-style/ | 2026-05-17 | relays | 2026-11-08T19:12:17Z | 200 | secondary (R05) |
| round1-2026-11-08/026 | Infosecurity Magazine, "40,000+ Exposed OpenClaw" | https://www.infosecurity-magazine.com/news/researchers-40000-exposed-openclaw/ | 2026-02-09 | relays | 2026-11-08T19:12:19Z | 200 | secondary |
| round1-2026-11-08/027 | The Hacker News, Hermes agent | https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html | July 2026 | relays Hunt.io | 2026-11-08T19:12:21Z | 200 | secondary (R08) |
| round1-2026-11-08/028 | Censys ARC, "MCP Servers on the Internet" | https://censys.com/blog/mcp-servers-on-the-internet/ | 2026-05-27 | as of 2026-04-28; note of 2026-05-06 | 2026-11-08T19:12:24Z | 200 | admitted (two counts) |
| round1-2026-11-08/029 | Knostic, "Mapping MCP Servers" | https://www.knostic.ai/blog/mapping-mcp-servers-study | 2025-07-17 | not stated | 2026-11-08T19:12:27Z | 200 | admitted |
| round1-2026-11-08/030 | Pluto Security, "Wide Open" | https://pluto.security/blog/wide-open-hundreds-of-mcps-exposing-root-shells-production-data-and-citizen-records-one-call-away/ | 2026-09-24 | several passes | 2026-11-08T19:12:29Z | 200 | admitted |
| round1-2026-11-08/031 | arXiv 2608.00150, "Exposed by Design" abstract | https://arxiv.org/abs/2608.00150 | 2026-07-31 | July 2026 | 2026-11-08T19:12:32Z | 200 | admitted |
| round1-2026-11-08/032 | Shadowserver, "Accessible ADB Report" description | https://www.shadowserver.org/what-we-do/network-reporting/accessible-adb-report/ | description updated 2023-12-07 | 2026-11-08T19:12:34Z | 200 | method only; its dashboard unread (R15) | |
| round1-2026-11-08/033 | chlebda.de, exposed ADB research | https://chlebda.de/blog/thousands-android-devices-exposed-adb.html | 2026-03-04 | a 20 to 30 minute session | 2026-11-08T19:12:36Z | 200 | admitted (partial scope) |
| round1-2026-11-08/034 | Synthient, "A Broken System Fueling Botnets" | https://synthient.com/blog/a-broken-system-fueling-botnets | 2026-01-02, modified 2026-11-02 | not stated | 2026-11-08T19:12:40Z | 200 | admitted (proxy pool); infection estimate as context (R13) |
| round1-2026-11-08/035 | Axios, Censys exclusive | https://www.axios.com/2026/10/13/censys-ai-vibe-coding-exposures | 2026-10-13 | 2026-11-08T19:12:43Z | 403 | unread: HTTP 403 | |
| round1-2026-11-08/036 | arXiv 2604.19487, IPv6 periphery abstract | https://arxiv.org/abs/2604.19487 | 2026-04-21, v3 2026-07-07 | 2026-11-08T19:12:45Z | 200 | no count in the abstract | |
| round2-2026-11-08/001 | OpenA2A Research, April 2026 exposure sweep | https://research.opena2a.org/reports/april-2026-exposure-sweep | 2026-04-10 | sweep of 2026-04-11 | 2026-11-08T19:16:46Z | 200 | admitted (C15, C44) |
| round2-2026-11-08/002 | OpenA2A Research, reports index | https://research.opena2a.org/reports | 2026-11-08T19:16:49Z | 200 | list of reports | ||
| round2-2026-11-08/003 | Intruder, "From enterprise chatbots to gooner caves" | https://www.intruder.io/research/from-enterprise-chatbots-to-gooner-caves-exposed-ai-infrastructure-is-rampant | 2026-03-27, updated 2026-04-02 | not stated | 2026-11-08T19:16:51Z | 200 | admitted (C13, C31, C32); 1 million not admitted (R14) |
| round2-2026-11-08/004 | VMblog, Censys press release | https://vmblog.com/news/censys-2026-state-of-the-internet-report-finds-exposed-ai-infrastructure-grew-63-in-nine-months/ | 2026-11-08T19:16:54Z | 403 | unread: HTTP 403 | ||
| round2-2026-11-08/005 | Help Net Security on Censys report | https://www.helpnetsecurity.com/2026/10/15/exposed-ai-infrastructure-report/ | 2026-10-15 | October 2025 to July 2026 | 2026-11-08T19:16:56Z | 200 | secondary (R06, R07) |
| round2-2026-11-08/006 | CSA research note, 36,769 exposed AI endpoints | https://labs.cloudsecurityalliance.org/research/csa-research-note-exposed-ai-endpoints-20260915-csa-styled/ | 2026-09-15 | relays Mysterium | 2026-11-08T19:16:59Z | 200 | secondary; led to Mysterium |
| round2-2026-11-08/007 | arXiv 2505.02502v2 HTML | https://arxiv.org/html/2505.02502v2 | 2025-08-26 | as of 2025-04-20 (FOFA) | 2026-11-08T19:17:01Z | 200 | admitted (C22, C25, C26, C34, C35, aggregate) |
| round2-2026-11-08/008 | runZero, Ollama blog | https://www.runzero.com/blog/ollama/ | 2026-11-08T19:17:04Z | 200 | no count found | ||
| round3-2026-11-08/001 | OpenA2A Research, March 2026 exposure sweep | https://research.opena2a.org/reports/march-2026-exposure-sweep | 2026-03-14 | 2026-03-14 to 2026-03-20 | 2026-11-08T19:17:49Z | 200 | admitted (C16, C43, aggregate); estimate not admitted (R16) |
| round3-2026-11-08/002 | OpenA2A Research, January report (97,000 hosts) | https://research.opena2a.org/reports/state-of-ai-agent-security | 2026-02-05, corrected 2026-10-06 | not stated | 2026-11-08T19:17:52Z | 200 | admitted (aggregate) |
| round3-2026-11-08/003 | OpenA2A Research, FOITW page | https://research.opena2a.org/reports/foitw | 2026-11-08T19:17:54Z | 200 | no exposure count used | ||
| round3-2026-11-08/004 | OpenA2A Research, exposure sweeps archive | https://research.opena2a.org/reports/exposure-sweeps | June 2026 sweeps | 2026-11-08T19:17:56Z | 200 | method context | |
| round3-2026-11-08/005 | OpenA2A Research, methodology | https://research.opena2a.org/methodology | 2026-11-08T19:17:59Z | 200 | method of the index (207 queries, category sums, UTC dating, 18 June boundary, ARIA authorship) | ||
| round3-2026-11-08/006 | OpenA2A, State of AI Agent Security, May 2026 | https://research.opena2a.org/reports/state-of-ai-agent-security-2026-05 | 2026-11-08T19:18:01Z | 200 | fetched; not used (the index holds the sweeps) | ||
| round3-2026-11-08/007 | OpenA2A, State of AI Agent Security, October 2026 | https://research.opena2a.org/reports/state-of-ai-agent-security-2026-10 | 2026-11-08T19:18:04Z | 200 | fetched; not used | ||
| round3-2026-11-08/008 | Security Affairs on Mysterium VPN | https://securityaffairs.com/198898/ai/the-ai-supply-chain-has-a-security-problem-and-much-of-it-is-sitting-on-the-open-internet.html | 2026-09-11 | relays | 2026-11-08T19:18:06Z | 200 | secondary; led to Mysterium |
| round4-2026-11-08/001 | OpenA2A Research, Exposure Prevalence Index | https://research.opena2a.org/indices/exposure-prevalence | live; latest sweep 2026-11-01 | 2026-03-14 to 2026-11-01 | 2026-11-08T19:18:34Z | 200 | admitted (series S42 to S45, S57) |
| round4-2026-11-08/002 | OpenA2A Research, indices page | https://research.opena2a.org/indices | 2026-11-08T19:18:37Z | 200 | context | ||
| round5-2026-11-08/001 | Mysterium VPN, "We exposed AI supply chain" | https://www.mysteriumvpn.com/blog/data-and-research/we-exposed-ai-supply-chain | updated 2026-09-10 | queries of 2026-08-30 and 31 (Netlas) | 2026-11-08T19:19:33Z | 200 | admitted |
Pages not fetched by rule: the third-party OpenClaw Exposure Watchboard (it lists individual hosts). Pages not found: Bitsight's own OpenClaw post, Hunt.io's own Hermes report, the Ollama paper's aggregate data release, an internet-wide 2025 or 2026 count of exposed ADB other than Shadowserver's (unread). Scanner query interfaces (Shodan, Censys, FOFA, ZoomEye, Netlas, LeakIX) were not used.
From studies/LH042/sources.md in the repository, last changed 9 November 2026.