Over 1,100 Ollama AI Servers Found Online, 20% at Risk

Over 1,100 Ollama AI servers were found exposed on the public internet, with approximately 20% hosting vulnerable models, according to Cisco Talos specialists. In a ten-minute sweep, researchers identified 1,140 internet-facing Ollama endpoints, of which roughly 228 were serving LLMs without proper access controls or authentication mechanisms.

The exposure allows adversaries to query models at will, extract metadata, reverse-engineer weights, or inject malicious code, threatening intellectual property, infrastructure integrity, and user privacy. Public Ollama instances can enable model extraction, jailbreaking and malicious content generation, and backdoor injection or model poisoning, claims the researchers.

Although 80% of identified servers were tagged as inactive, Cisco warns these endpoints remain highly exploitable and can be repurposed for DoS attacks or configuration tampering. Geographically, the United States hosts the largest share of exposed Ollama servers (36.6%), followed by China (22.5%) and Germany (8.9%), reflecting a broader trend of deploying AI locally without foundational cybersecurity hygiene.