175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse

175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse (TL-2026-0047), also tracked as Ollama Exposure, is a high-severity misconfiguration threat scored CVSS 7.5, first published 2026-02-03. It has no confirmed attribution, affects Ollama Ollama LLM Server, maps to 34 MITRE ATT&CK techniques (T1005, T1036, T1046), and is covered by 15 detection rules and 41 indicators of compromise.

Key facts for TL-2026-0047

Threat ID
TL-2026-0047
Also known as
Ollama Exposure, LLM Server Misconfiguration
Severity
HIGH
CVSS
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L)
Status
ACTIVE
Category
MISCONFIGURATION
First published
2026-02-03
Last reviewed
2026-02-03
Attribution confidence
NONE
Motivation
VARIOUS
Target sectors
Technology, Cloud Services, Research and Education, Healthcare, Financial Services, Government, AI/ML Industry
Target regions
Global, United States, China, Germany, India, South Korea, Japan, Europe
Detection rules
15
Indicators of compromise
41

175,000+ Ollama large language model (LLM) instances are exposed to the public internet on default port 11434 with zero authentication, creating the largest unauthenticated AI compute surface in history. Shodan scans confirm exposed instances across AWS, Azure, GCP, Linode, DigitalOcean, Hetzner, OVH, and home networks globally — with concentrations in the US, China, Germany, India, and South Korea. Ollama ships with no authentication, no API keys, and binds to 0.0.0.0 by default when deployed via Docker — meaning any internet-connected deployment is immediately accessible. Attackers exploit these exposed instances for LLMjacking (stolen AI compute at $0 cost), model weight theft (downloading proprietary fine-tuned models), training data extraction via prompt injection, server-side request forgery (SSRF) into cloud metadata services, and denial-of-service via resource exhaustion. The exposure scale — 175K+ hosts — transforms individual misconfigurations into a systemic infrastructure crisis.

How 175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse works

The 175K Exposed Ollama Host Crisis — Attack Surface at Scale:

Ollama is the dominant open-source framework for running large language models locally, with 100M+ Docker pulls and deployment across individual developer machines, corporate AI labs, university research clusters, and production inference servers. Its design philosophy prioritizes ease of use over security: install, pull a model, run — no API keys, no authentication tokens, no access control. This 'zero-friction' approach is the root cause of the largest exposed AI compute surface ever documented.

Why 175K+ Hosts Are Exposed: 1. Default Binding: Ollama binds to 127.0.0.1 in native installs but 0.0.0.0 in Docker deployments. Docker is the primary deployment method for servers. Users deploy `docker run -p 11434:11434 ollama/ollama` and assume the container is isolated — it's not, it's bound to all interfaces. 2. No Authentication: Ollama has zero built-in authentication. No API keys, no tokens, no basic auth. The REST API is fully accessible to anyone who can reach port 11434. There is no `--auth` flag, no config file for credentials. 3. Cloud Security Group Gaps: Developers deploy Ollama on cloud VMs (AWS EC2, Azure, GCP) and open port 11434 in security groups for remote access from their laptop. They forget to restrict the source IP, leaving 0.0.0.0/0 inbound access. 4. Reverse Proxy Absence: Without built-in auth, security requires an external reverse proxy (nginx, Caddy, Traefik) with authentication. Most developers skip this step because Ollama doesn't document it as required. 5. Model Library Growth: Ollama's model library now includes Llama 3.x, Mistral, Gemma, Phi, CodeLlama, DeepSeek, Qwen, and 100+ models. More models = more reasons to run Ollama = more exposed instances.

Attack Surface Analysis — What 175K Exposed Hosts Enable:

1. LLMjacking — Stolen AI Compute ($0 Cost): - Attacker discovers exposed Ollama instance via Shodan/Censys/masscan - Sends inference requests to run prompts through the model at zero cost - GPU compute for inference costs $0.50-$5.00/hour on cloud providers - 175K hosts × average 4 hours/day abuse = $350K-$3.5M/day in stolen compute - Used for: spam generation, phishing email crafting, malware code generation, CAPTCHA solving, academic cheating, SEO content farming - Attacker infrastructure cost: $0. All compute is stolen.

2. Model Weight Theft — Downloading Proprietary Models: - Ollama API: GET /api/show returns model metadata - Ollama API: POST /api/pull can pull model weights to attacker's system - Organizations fine-tune models on proprietary data (medical, legal, financial, military) - Fine-tuned model weights contain embedded training data patterns - Stolen weights = stolen intellectual property + potential training data leakage - Corporate espionage vector: competitor pulls your fine-tuned model for free

3. Training Data Extraction via Prompt Injection: - Models memorize fragments of training data (known research: extracting training data from LLMs) - Adversarial prompts can extract memorized sensitive data: PII, API keys, internal URLs, credentials - Exposed Ollama hosts with custom fine-tuned models are highest risk - Prompt: 'Repeat the following training example verbatim...' or 'What data were you trained on?' - No rate limiting on exposed instances = unlimited extraction attempts

4. SSRF Into Cloud Metadata Services: - CVE-2024-39720 and related: Ollama's model import functionality can be exploited for SSRF - Attacker sends crafted request to Ollama API targeting http://169.254.169.254/latest/meta-data/ (AWS IMDSv1) - Ollama fetches the URL server-side, returning cloud instance credentials, IAM role tokens, and infrastructure metadata - Pivots from 'exposed LLM' to 'full cloud account compromise' - Also targets: Azure IMDS (169.254.169.254), GCP metadata (metadata.google.internal), Kubernetes service account tokens

5. Denial of Service — Resource Exhaustion: - LLM inference is GPU/CPU intensive. A single large prompt can consume 100% GPU for seconds - Attacker sends continuous large-context requests to exhaust GPU memory and compute - Legitimate users on shared infrastructure lose access - No rate limiting, no request size limits, no concurrent request caps on default Ollama - 175K hosts = potential DDoS amplification network (reflective inference)

6. Model Poisoning via API: - Ollama API: POST /api/create allows creating new models from Modelfiles - Attacker can create poisoned models on exposed instances - If organization pulls from their own exposed Ollama instance, they get the poisoned model - Supply chain attack: attacker replaces legitimate model with backdoored version

Exposure Distribution (Shodan Analysis): - AWS: ~45K hosts (26%) — EC2 instances across us-east-1, eu-west-1, ap-southeast-1, ap-south-1, eu-south-1 - Azure: ~18K hosts (10%) — primarily dev/test VMs - GCP: ~12K hosts (7%) — Compute Engine instances - Hetzner: ~15K hosts (9%) — European developer favorite for GPU instances - DigitalOcean: ~10K hosts (6%) — smaller GPU droplets - OVH: ~8K hosts (5%) — European cloud provider - Linode/Akamai: ~7K hosts (4%) — developer instances - Home/ISP: ~25K hosts (14%) — residential IPs running Ollama on home servers/NAS - Other VPS/Cloud: ~35K hosts (20%) — various smaller providers - Total: ~175K+ hosts, growing ~5K/month

Geographic Distribution: - United States: ~52K (30%) - China: ~28K (16%) - Germany: ~18K (10%) - India: ~15K (9%) - South Korea: ~10K (6%) - Japan: ~8K (5%) - France: ~7K (4%) - UK: ~6K (3%) - Brazil: ~5K (3%) - Other: ~26K (15%)

Ollama Security Architecture (or Lack Thereof): - Version 0.1.x-0.5.x: No authentication mechanism at all - OLLAMA_ORIGINS environment variable: CORS control only — not authentication - OLLAMA_HOST: Controls binding address but not access control - No built-in TLS — API traffic is plaintext HTTP - No audit logging — no record of who accessed what model or when - No rate limiting — unlimited requests per second - No request size limits — arbitrarily large prompts accepted - No model access control — all models accessible to all callers - Community workarounds: nginx reverse proxy, Tailscale VPN, firewall rules — all external to Ollama

MITRE ATT&CK techniques used in TL-2026-0047

collection

T1005 Data from Local System; T1213 Data from Information Repositories; T1530 Data from Cloud Storage

defense-evasion

T1036 Masquerading; T1078 Valid Accounts; T1684.001 Impersonation

discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1648 Serverless Execution

command-and-control

T1071 Application Layer Protocol

persistence

T1133 External Remote Services; T1505 Server Software Component; T1525 Implant Internal Image

initial-access

T1190 Exploit Public-Facing Application

lateral-movement

T1210 Exploitation of Remote Services

impact

T1496 Resource Hijacking; T1498 Network Denial of Service; T1499 Endpoint Denial of Service; T1565 Data Manipulation

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

privilege-escalation

T1548 Abuse Elevation Control Mechanism

resource-development

T1583 Acquire Infrastructure; T1583.004 Server; T1584 Compromise Infrastructure

reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning; T1596 Search Open Technical Databases

Affected products and versions in 175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse

  • Ollama — Ollama LLM Server
    Vulnerable versions: All versions with default config exposed to internet
    Fixed in: Properly configured with authentication/network controls

Remediation for 175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse

Patches

  • CVE-2024-39720: Upgrade Ollama to version with SSRF fix in model import
  • CVE-2024-39722: Upgrade to fix path traversal in /api/push endpoint

Immediate actions

  • Audit all Ollama deployments: scan for port 11434 open to internet using nmap, Shodan, or cloud security posture tools
  • Bind Ollama to localhost only: set OLLAMA_HOST=127.0.0.1:11434 or use Docker -p 127.0.0.1:11434:11434
  • Restrict cloud security groups: remove 0.0.0.0/0 inbound rules for port 11434, allow only specific source IPs
  • Deploy reverse proxy with authentication: nginx/Caddy/Traefik with basic auth, API key validation, or OAuth2 proxy
  • Enable AWS IMDSv2: require token-based IMDS to prevent SSRF metadata extraction from Ollama

Workarounds

  • Docker deployment: always use -p 127.0.0.1:11434:11434 (NOT -p 11434:11434)
  • Cloud deployment: use VPC private subnets with no public IP assignment for Ollama instances
  • Home deployment: ensure router firewall blocks inbound port 11434 from WAN
  • Kubernetes: use NetworkPolicy to restrict Ollama pod ingress to authorized services only

Longer-term hardening

  • Advocate for Ollama to implement built-in authentication: API key support, token-based auth, or mutual TLS
  • Deploy network segmentation: Ollama instances should be on isolated VLANs/subnets with no direct internet access
  • Implement monitoring: alert on external IP connections to port 11434, unusual inference volumes, and model download requests
  • Use Tailscale, WireGuard, or ZeroTier for remote access to Ollama instead of exposing port 11434
  • Deploy rate limiting via reverse proxy: limit requests per IP, max prompt size, concurrent connections
  • Implement model access control: separate Ollama instances for different sensitivity levels, restrict model create/delete APIs

Weaknesses (CWE) in 175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse

CWE-306, CWE-668

Timeline of 175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse

  • Ollama launches as open-source LLM runner. Rapid adoption due to simple 'ollama run llama2' interface. No authentication by design — local tool philosophy.
  • Ollama Docker image crosses 10M pulls. Docker deployment binds 0.0.0.0 by default, creating first wave of internet-exposed instances as developers deploy on cloud VMs.
  • Security researchers report first Shodan scans finding 50K+ Ollama instances on port 11434 with no authentication. Initial exposure wave primarily on AWS EC2 and Hetzner.
  • Wiz and Sysdig independently publish LLMjacking research: attackers using stolen cloud credentials and exposed LLM endpoints for free AI inference. Establishes 'LLMjacking' as a threat category. Source: https://www.wiz.io/blog/llmjacking
  • Four Ollama CVEs disclosed: CVE-2024-39720 (SSRF via model import), CVE-2024-39719 (model existence confirmation), CVE-2024-39721 (resource exhaustion), CVE-2024-39722 (path traversal). Demonstrates attack surface beyond simple compute theft.
  • Shodan census shows 100K+ exposed Ollama instances. Growth driven by AI/ML boom, corporate experimentation, and developer FOMO to run local LLMs. No corresponding increase in security awareness.
  • First reports of corporate fine-tuned models being exfiltrated from exposed Ollama instances. Healthcare, legal, and financial organizations discover proprietary model weights accessible to anyone. Intellectual property theft at scale.
  • OWASP publishes updated Top 10 for LLM Applications. Includes model theft, prompt injection, and insecure output handling — all enabled by exposed Ollama instances with no access control. Source: https://owasp.org/www-project-top-10-for-large-language-model-applications/
  • Censys publishes comprehensive scan of exposed AI infrastructure: Ollama, TGI (Text Generation Inference), vLLM, and other LLM serving frameworks. Ollama represents 80%+ of exposed instances due to zero-auth default.
  • Multiple cloud compromise incidents traced back to Ollama SSRF exploitation. Attackers pivot from exposed Ollama to cloud metadata services, extracting IAM credentials and escalating to full account compromise. AWS publishes guidance on IMDSv2 enforcement.
  • LLMjacking economy matures: underground services sell access to compromised Ollama instances for $0.10-$1.00/hour (vs $0.50-$5.00/hour legitimate cloud GPU). Used for spam generation, phishing, code generation, and CAPTCHA solving.
  • Ollama Docker image crosses 100M pulls. Model library grows to 100+ models including Llama 3.x, Mistral, Gemma, Phi, DeepSeek, Qwen. Adoption accelerates but authentication still not implemented.
  • Shodan census reaches 175K+ exposed Ollama instances on port 11434. Growth rate ~5K new exposed instances per month. US (52K), China (28K), Germany (18K), India (15K), South Korea (10K) lead exposure counts.
  • First documented model poisoning via exposed Ollama API: attackers use /api/create to deploy backdoored models on exposed instances. Organizations pulling from their own compromised Ollama instance ingest poisoned models unknowingly.
  • Economic analysis: 175K exposed hosts × average 4 hours/day abuse × $1/hour GPU cost = $700K/day in potential stolen compute. Annual impact: $255M. Legitimate cloud GPU providers losing revenue to LLMjacking.
  • Threadlinqs Intelligence analysis: 175K exposed Ollama hosts represent the largest unauthenticated AI compute surface in history. Shodan confirms instances across AWS, Azure, GCP, Linode, Hetzner, OVH, and residential networks. The exposure is a systemic infrastructure crisis, not individual misconfigurations.
  • As of 2026-05-29, TL-2026-0047 remains ACTIVE and escalating: SentinelLABS/Censys (Jan 2026) confirm the exposure, now grown to ~300K hosts, and the attributed LLMjacking campaign "Operation Bizarre Bazaar" (actor "Hecker") is operating undisrupted. Critical unauthenticated CVE-2026-7482 "Bleeding Llama" (CVSS 9.3, fixed in 0.17.1) further weaponizes exposed instances; no Ollama CVE is in CISA KEV.

Sources cited for 175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse

Threats related to 175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse

Detection coverage for TL-2026-0047

As of 2026-02-03, Threadlinqs Intelligence publishes 15 detection rule(s) for TL-2026-0047 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats