Over 1,100 Ollama AI Servers Exposed on Public Internet
Cisco Talos researchers discovered over 1,100 Ollama AI servers exposed on the public internet without authentication, with about 20% actively hosting models. The exposed servers create risks for model extraction attacks, jailbreaking, unauthorized resource consumption, and potential cloud cost generation through compromised endpoints.
What happened
Researchers from Cisco Talos used the Shodan scanning tool to search for unsecured Ollama instances and identified more than 1,100 publicly accessible servers.
About 20% were actively hosting models susceptible to unauthorized access, while the remainder were not currently running models but remained susceptible to exploitation via unauthorized model uploads or configuration manipulation.
Reported impact
Potential threats include model extraction attacks through repeated queries to reconstruct model parameters, jailbreaking and content abuse to produce malicious output, and backdoor injection via malicious payload uploads or untrusted model loads.
An unauthorized user could query the model or its API, consume computational resources, generate cloud-usage fees if the server is linked to hosted systems, or access information that could identify hosts for targeted attacks.
Index analysis
Exposed interfaces could enable denial-of-service attacks, resource exhaustion, or lateral movement even on servers without active models.
Businesses have neglected fundamental security practices in deploying these systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.