Initializing threat map...
The Great AI Data Leak: Map of Exposed Vector Databases
This map plots AI services that Shodan's internet-wide scans have indexed: vector databases (Milvus, Qdrant, ChromaDB, Weaviate), an LLM inference server (Ollama) and AI deployment frameworks (LangServe, Ray, MLflow). The map is rebuilt from Shodan search results once every 24 hours, and does not change between rebuilds. Building the map sends no request to any plotted host: every point is a Shodan search result. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it.
What a Point on This Map Means
Only the Qdrant, Weaviate and Ollama searches require an HTTP 200: those points are services that Shodan recorded answering its scanners, which send no credentials, with HTTP 200 OK. The Milvus, ChromaDB, LangServe, Ray and MLflow searches do not filter on HTTP status: a point from one of them is a service whose Shodan record matches the search's port, banner text or page title, and its HTTP status is not checked. Each search reads up to 1,000 matches, and a host matched by more than one search is plotted once, under the first in the table below. A point shows what Shodan recorded; EchelonGraph does not re-check it.
| Product | Shodan search | Requires HTTP 200 |
|---|---|---|
| Qdrant | port:6333 http.status:200 | Yes |
| Weaviate | port:8080 http.status:200 weaviate | Yes |
| Milvus | port:19530 -401 -403 | No |
| Ollama | port:11434 http.status:200 Ollama | Yes |
| ChromaDB | port:8000 chromadb | No |
| LangServe | http.title:"LangServe" | No |
| Ray | port:8265 http.title:"Ray Dashboard" | No |
| MLflow | port:5000 http.title:"MLflow" | No |
Correction, 2026-09-27: point ids. Until 2026-09-27, each point in this map's data carried an id that was an unsalted SHA-256 hash of the host's IP address. Hashing every IPv4 address reverses a hash like that, so every id served before that date can be turned back into its host's address. A point's id is now only its position in the list of points: it is not computed from the address and cannot be turned back into it.
Correction, 2026-09-27: network names. Until 2026-09-27, each point on this map showed the organisation that Shodan records as the owner of the host's network, with that network's number (ASN); those owners included companies, universities and some private individuals. Each point now names its network only when it belongs to one of the hosting and cloud providers on EchelonGraph's list, and shows every other network as "Other network", with no name or number.
The Products on This Map
- Milvus — Open-source vector database for AI/ML similarity search. Authentication is off unless it is configured.
- Qdrant — High-performance vector search engine. Default configuration exposes REST API on port 6333 without authentication.
- ChromaDB — AI-native embedding database used in RAG pipelines. Its server listens on port 8000 and has no authentication unless it is configured.
- Weaviate — Vector search engine with GraphQL API. An instance without authentication serves its stored objects to anyone who queries it.
- Ollama — Local LLM inference server whose API has no authentication of its own. An instance reachable from the internet runs models for anyone who asks.
- LangServe — LangChain deployment framework that serves chains over HTTP, with a playground page for each.
- Ray — The Ray Dashboard, the web UI and Jobs API of a Ray compute cluster. Submitting a job to one left open runs code on the cluster (CVE-2023-48022, "ShadowRay").
- MLflow — The MLflow Tracking UI and model registry. Its authentication is an optional app that is off by default.
Why Perimeter Security Fails for AI Infrastructure
Traditional perimeter security was designed for monolithic applications with predictable network boundaries. AI infrastructure breaks this model fundamentally: vector databases store high-dimensional embeddings that encode proprietary business logic, customer data, and model weights. When a junior developer spins up a Milvus instance to "get it working quickly" and forgets to enable authentication, the result is not just an open port — it is a complete data exfiltration surface.
Attackers can extract embeddings, poison training data, steal model configurations, and execute destructive operations — all without triggering traditional IDS/IPS alerts because the requests look like legitimate API calls returning 200 OK.
Secure Your AI Infrastructure with Zero-Knowledge Telemetry
EchelonGraph's Zero-Knowledge Telemetry Processing provides continuous visibility into your AI infrastructure without ever accessing your data. Detect unauthenticated exposures, misconfigured vector databases, and shadow AI deployments before attackers find them. Unlike traditional scanners, EchelonGraph operates at the telemetry layer.
EchelonGraph-<Radar>/1.0 (+https://echelongraph.io/surface-scanner; opt-out https://echelongraph.io/responsible-disclosure; [email protected]) or, from our radar prober, EchelonGraphBot/1.0 (+https://echelongraph.io/bot), and their HTTP requests to the hosts they check also carry a From: [email protected] header. Some checks are a single identified GET; others send several requests to one host. Confirming an MCP endpoint sends a POST asking the server which protocol versions it supports, a second POST with the older handshake only if the first is refused without a 2026-07-28 error, a DELETE to close any session a POST opened and, if a POST is refused with HTTP 401 or 403, up to two GETs of the server's OAuth protected-resource metadata on the same host; where neither POST finds an MCP endpoint, the older SSE transport's stream is requested with GET, only its first event is read, and the connection is closed. A server that answers the first POST with a DiscoverResult, or with an error the 2026-07-28 revision defines, opens no session and is sent no further POST, so it is not written to; if the POST is refused with HTTP 401 or 403, the metadata GETs above still follow. Confirming an exposed datastore needs a protocol-level exchange, and on Redis our client names itself so the connection is identifiable in your own CLIENT LIST. We never log in, submit credentials or exploit what we find. Who we are, exactly what each check sends, and how to opt out → A radar's HTTP requests to the host it checks also carry a signed receipt you can validate at /verify-scan.