Table of Contents
Ollama AI servers — 175,000 of them — are sitting on the open internet across 130 countries with no authentication, no firewall, and no oversight, creating what security researchers call an “unmanaged, publicly accessible layer of AI compute infrastructure” that is already being exploited for LLMjacking.
Key Takeaway
- 🌍 175,000 Exposed: SentinelOne SentinelLABS and Censys identified 175,000 publicly accessible Ollama AI servers across 130 countries — the vast majority running with no authentication
- 🔧 48% Have Tool-Calling: Nearly half of observed hosts advertise tool-calling capabilities, meaning they can execute code, access APIs, and interact with external systems — dramatically expanding the attack surface
- 💀 LLMjacking Active: Threat actors are actively scanning for exposed Ollama instances, validating endpoints, and reselling access through Operation Bizarre Bazaar — the first documented LLMjacking marketplace with complete attribution
- 🔓 Zero-Auth Default: Ollama binds to localhost by default, but a single configuration change to 0.0.0.0 exposes the server publicly — and 175,000 operators made that change without adding a firewall or password
- 🛡️ CVE-2026-7482: The “Bleeding Llama” vulnerability (CVSS 9.1) allows unauthenticated attackers to read process memory — including API keys, environment variables, and conversation data — from unpatched servers
When security researchers from SentinelOne SentinelLABS and Censys mapped the open-source AI infrastructure in January 2026, they found something that should terrify any organization running local AI models: 175,000 Ollama AI servers sitting on the public internet with no password, no authentication, and no firewall. These servers span 130 countries. They run on both cloud and residential networks. And nearly half of them have tool-calling capabilities that allow them to execute code, access APIs, and interact with external systems. This is not a potential risk — it is an active attack surface that criminal groups are already exploiting.
The findings, published in a joint investigation by SentinelOne and Censys, reveal that the rapid adoption of open-source AI tools has outpaced the security practices needed to deploy them safely. As organizations race to run large language models locally for cost, privacy, and performance reasons, they are creating what the researchers describe as “an unmanaged, publicly accessible layer of AI compute infrastructure” that operates entirely outside the guardrails and monitoring systems that platform providers implement by default. This connects to the broader AI security challenges we documented in our AI cyberattacks 2026 report — the AI infrastructure layer is becoming the next major attack frontier.
What Are Ollama AI Servers and Why Are They Exposed?
Ollama is an open-source framework that allows users to download, run, and manage large language models locally on Windows, macOS, and Linux. It has become one of the most popular tools for organizations and developers who want to run AI models on their own hardware rather than paying for API access to cloud-based models. The appeal is clear: lower costs, data privacy, no dependency on external APIs, and the ability to customize models for specific use cases.
The security problem is architectural. By default, Ollama binds to the localhost address at 127.0.0.1:11434 — meaning the AI server is only accessible from the same machine it is running on. This is secure. But Ollama makes it trivially easy to expose the server to the public internet by changing the binding address to 0.0.0.0 or a public interface. When an operator makes this change — often to allow other machines on their network to access the AI server — without simultaneously configuring a firewall or authentication, the server becomes publicly accessible to anyone on the internet.
According to the SentinelOne and Censys investigation, 175,000 operators made this exact mistake. The Ollama AI servers they identified are not hacked — they are misconfigured. The operators changed one environment variable and skipped the security step. The result is a vast, unauthenticated AI infrastructure that anyone can access, query, and exploit.
The Geographic Distribution of Exposed Servers
The exposed Ollama AI servers are distributed across 130 countries, with China accounting for approximately 30% of all exposed hosts. The countries with the most significant infrastructure footprint include the United States, Germany, France, South Korea, India, Russia, Singapore, Brazil, and the United Kingdom.
This geographic spread is significant for two reasons. First, it demonstrates that the misconfiguration problem is global — it is not concentrated in any single region or regulatory environment. Second, the presence of exposed servers in countries with strong data protection regulations (Germany, France, UK) suggests that regulatory compliance does not automatically translate to operational security. Organizations can be GDPR-compliant and still have an unauthenticated AI server leaking data on the public internet.
Tool-Calling: Why This Changes the Threat Model
Of the 175,000 observed hosts, more than 48% advertise tool-calling capabilities via their API endpoints. Tool calling (also known as function calling) is a capability that allows LLMs to interact with external systems, APIs, and databases, enabling them to augment their capabilities or retrieve real-time data. When queried, these endpoints return metadata highlighting the functionalities they support.
This is the finding that elevates the Ollama AI servers exposure from a curiosity to a critical security concern. As researchers Gabriel Bernadett-Shapiro and Silas Cutler noted: “Tool-calling capabilities fundamentally alter the threat model. A text-generation endpoint can produce harmful content, but a tool-enabled endpoint can execute privileged operations. When combined with insufficient authentication and network exposure, this creates what we assess to be the highest-severity risk in the ecosystem.”
The distinction is crucial. An exposed text-generation LLM can be abused to generate spam, disinformation, or harmful content — but the damage is limited to the content itself. An exposed tool-enabled LLM can execute code, access databases, interact with APIs, and perform actions on external systems. If an organization’s Ollama server has tool-calling enabled and is publicly accessible, an attacker could potentially use it to execute commands, access internal systems, or exfiltrate data through the AI server’s connected tools. This is the AI equivalent of leaving a server with SSH access open to the internet with no password.
The researchers also identified 201 hosts running uncensored prompt templates that remove safety guardrails, as well as hosts supporting vision and reasoning capabilities beyond text generation. These uncensored hosts are particularly dangerous because they lack the safety filters that would normally prevent the model from generating harmful content or executing malicious instructions.
LLMjacking: The Criminal Marketplace
The exposure of Ollama AI servers is not just a theoretical risk — it is already being monetized by criminal groups. According to a report by Pillar Security, threat actors are actively targeting exposed LLM service endpoints as part of an LLMjacking campaign dubbed Operation Bizarre Bazaar.
The operation has three components, as documented by The Hacker News: First, systematically scanning the internet for exposed Ollama instances, vLLM servers, and OpenAI-compatible APIs running without authentication. Second, validating the endpoints by assessing response quality — ensuring the AI server is functional and capable of handling requests. Third, commercializing the access at discounted rates by advertising it on silver.inc, which operates as a Unified LLM API Gateway.
“This end-to-end operation — from reconnaissance to commercial resale — represents the first documented LLMjacking marketplace with complete attribution,” said researchers Eilon Cohen and Ariel Fogel from Pillar Security. The operation has been traced to a threat actor named Hecker (also known as Sakuya and LiveGamer101).
LLMjacking allows criminals to abuse a victim’s AI infrastructure for their own purposes while the victim foots the bill. The abuse ranges from generating spam emails and disinformation campaigns to cryptocurrency mining and reselling access to other criminal groups. For organizations running exposed Ollama AI servers, this means their GPU compute resources — which are expensive and scarce — could be quietly consumed by criminals without the operator’s knowledge.
CVE-2026-7482: The Bleeding Llama Vulnerability
The exposure problem is compounded by CVE-2026-7482, nicknamed “Bleeding Llama” — a heap out-of-bounds read vulnerability in Ollama versions prior to 0.17.1 that affects the /api/create endpoint. The vulnerability, disclosed in May 2026 with a CVSS score of 9.1, allows unauthenticated attackers to read process memory from affected servers using just three API calls.
What makes Bleeding Llama particularly dangerous is the type of data it exposes. According to Cyera’s disclosure, the vulnerability allows attackers to extract system prompts, API keys, environment variables, and conversation data from any unpatched server. This means that even if an organization’s Ollama server is not being used for LLMjacking, the mere fact that it is exposed and unpatched means attackers can extract the API keys and credentials stored in the server’s memory — potentially providing a pathway into other systems.
For organizations running Ollama AI servers, the fix is straightforward: update to version 0.17.1 or later. But the fact that 175,000 servers were exposed as of January 2026, and the vulnerability was disclosed in May 2026, means there is likely a significant overlap between exposed servers and vulnerable versions. As we noted in our GeoServer zero-day analysis, the gap between disclosure and patching is where attackers operate — and in the case of Ollama, that gap is measured in months, not days.
What Organizations Should Do Now
If your organization runs Ollama or any local AI model server, the following steps should be taken immediately:
1. Check your binding configuration. Verify that your Ollama server is bound to 127.0.0.1 (localhost) and not 0.0.0.0 or a public interface. If it must be accessible to other machines on your network, use a VPN or restrict access to specific IP addresses through firewall rules.
2. Update to the latest version. If you are running Ollama version 0.17.0 or earlier, update immediately to version 0.17.1 or later to patch the Bleeding Llama vulnerability. This is a critical update — the vulnerability allows unauthenticated memory reads that can expose API keys and credentials.
3. Disable tool-calling if not needed. If your use case does not require tool-calling capabilities, disable them. Tool-enabled endpoints represent the highest-severity risk because they can execute privileged operations, not just generate text.
4. Monitor for unauthorized access. Review server logs for unusual API requests, unexpected model loading activity, or spikes in GPU utilization that could indicate LLMjacking. The decentralized nature of Ollama deployments means monitoring must be done at the host level, not through a central platform.
5. Implement authentication. Ollama does not include built-in authentication by default, but it can be placed behind a reverse proxy with authentication (such as nginx with basic auth or OAuth). Any Ollama server accessible beyond localhost should have authentication enabled. For a broader understanding of AI security best practices, see our AI infrastructure security analysis.
The Broader Lesson: AI Infrastructure Needs Security by Default
The Ollama AI servers exposure reveals a fundamental tension in the open-source AI ecosystem. Ollama’s popularity stems from its simplicity — anyone can download, install, and run a large language model in minutes. But that same simplicity means security is an afterthought. There is no authentication prompt during installation. No firewall configuration wizard. No warning when a user changes the binding address to expose the server publicly. The framework assumes the user will handle security — and 175,000 users did not.
This is not unique to Ollama. As we tracked in our Ruflo MCP bridge vulnerability analysis, the broader AI tooling ecosystem is riddled with security gaps that become attack surfaces when tools are deployed without proper configuration. The challenge for the AI industry is to make security the default, not the optional add-on. Until that happens, the gap between AI adoption and AI security will continue to widen — and researchers will continue finding hundreds of thousands of exposed servers on the open internet.
Frequently Asked Questions About Ollama AI Servers
What are Ollama AI servers?
Ollama AI servers are instances of the Ollama open-source framework, which allows users to download, run, and manage large language models locally on Windows, macOS, and Linux. Ollama has become popular for organizations that want to run AI models on their own hardware for cost, privacy, and performance reasons.
How many Ollama servers are exposed on the internet?
SentinelOne SentinelLABS and Censys identified approximately 175,000 publicly accessible Ollama AI servers across 130 countries. The vast majority are running with no authentication, having been misconfigured to bind to a public network interface instead of localhost.
What is LLMjacking and how does it affect Ollama servers?
LLMjacking is the abuse of a victim’s AI infrastructure by unauthorized users. Threat actors scan for exposed Ollama instances, validate that they are functional, and resell access to them through criminal marketplaces like Operation Bizarre Bazaar. Victims pay for the GPU compute resources that criminals consume.
What is the Bleeding Llama vulnerability?
CVE-2026-7482, nicknamed “Bleeding Llama,” is a heap out-of-bounds read vulnerability in Ollama versions prior to 0.17.1. It allows unauthenticated attackers to read process memory — including API keys, environment variables, and conversation data — using just three API calls. The CVSS score is 9.1 (critical).
Why are tool-calling Ollama servers more dangerous?
Nearly 48% of exposed Ollama AI servers advertise tool-calling capabilities, which allow the LLM to execute code, access APIs, and interact with external systems. While an exposed text-generation endpoint can produce harmful content, a tool-enabled endpoint can execute privileged operations — making it the highest-severity risk in the ecosystem.
How can I secure my Ollama AI server?
Secure your Ollama AI servers by: (1) binding to localhost (127.0.0.1) instead of 0.0.0.0, (2) updating to version 0.17.1 or later to patch Bleeding Llama, (3) disabling tool-calling if not needed, (4) implementing authentication through a reverse proxy, and (5) monitoring server logs for unauthorized access or unusual GPU activity.
Which countries have the most exposed Ollama servers?
China accounts for approximately 30% of exposed Ollama AI servers. Other countries with significant exposure include the United States, Germany, France, South Korea, India, Russia, Singapore, Brazil, and the United Kingdom. The exposure spans 130 countries total.
What is Operation Bizarre Bazaar?
Operation Bizarre Bazaar is the first documented LLMjacking marketplace with complete attribution, traced to a threat actor named Hecker. The operation involves scanning for exposed Ollama instances, validating endpoints, and commercializing access through silver.inc, a Unified LLM API Gateway that sells stolen AI compute at discounted rates.
Sources: SentinelOne SentinelLABS and Censys joint investigation, January 2026 | The Hacker News, “Researchers Find 175,000 Publicly Exposed Ollama AI Servers Across 130 Countries,” January 29, 2026 | Pillar Security, Operation Bizarre Bazaar report | Cyera, CVE-2026-7482 “Bleeding Llama” disclosure, May 2026 | Cloud Security Alliance, LLMjacking research note
