Exposed AI Agents Are the New Shadow IT – Except They Can Act

Everybody is rushing to deploy AI agents. Almost nobody is securing them.

This week a tool called AIMap was published that scans the internet looking for exposed AI servers. The results? Over 175,000 Ollama servers exposed to the world. Over 8,000 MCP servers completely open. A million AI services scanned, a large proportion of them with no authentication whatsoever.

Let’s stop there for a second. Of 5,200 Ollama servers examined in depth, 31% responded to requests without requiring any identification at all. 518 of them wrapped models from Anthropic, OpenAI and Google – meaning somebody is paying for an expensive API, deploying it on a server, and not even putting a password on it.

This is not a bug. It is a pattern.

Every new technology goes through the same cycle

Somebody invents something remarkable. Everybody rushes to deploy. Security? We’ll handle that later. And later never arrives.

In 15 years of pentesting I have seen this with everything. With APIs that were open to the world. With Jenkins servers with no password. With S3 buckets anybody could read. Now it is AI agents. Same film, new cast.

But this time there is a twist

These AI agents are not just an endpoint returning JSON. They have access to tools. They have permissions. They have system prompts that leak out and reveal the whole internal logic. Some run as root. Some carry credentials embedded in the code. Some can execute code with no sandbox at all.

This is not shadow IT. This is shadow IT with the ability to act on the organisation’s behalf.

I am not saying do not deploy AI agents. I am saying that anyone deploying an agent with no auth, no TLS and no limit on its permissions is simply opening a back door into their own organisation and inviting everyone in.

So tell me: who in your organisation is responsible for the security of the AI agents? If there is no clear answer, you have a problem.

I first shared a version of this as a LinkedIn post on 2026-05-17. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula