175,000 Exposed Ollama Hosts Enable Code Execution and External System Access

Cybersecurity: Ollama Security Vulnerability

Recent findings have identified that approximately 175,000 Ollama servers are publicly accessible on the internet, presenting a significant risk for unauthorized code execution and external system access.

Ollama is an open-source framework designed for running artificial intelligence models locally. The exposure of these servers is due to configuration changes made without fully understanding their security implications.

Research indicates that these internet-facing servers can be manipulated to execute arbitrary code and interact with sensitive resources. This situation necessitates a reevaluation of AI infrastructure security practices.

The exposure results from a deployment oversight. By default, Ollama binds to a local-only address, making it inaccessible from the internet. However, a simple configuration change—binding the service to 0.0.0.0 or a public-facing interface—renders these systems vulnerable to internet access.

This vulnerability has emerged on a large scale as open-source AI models have become more prevalent in 2025. The affected deployments span 130 countries and 4,032 autonomous system networks.

SentinelLABS analysts, in collaboration with Censys, conducted a 293-day scanning operation to assess the threat landscape. This operation yielded 7.23 million observations, highlighting both the scope of the vulnerability and its potential for exploitation.

Approximately 38% of the observed hosts possess both text completion and tool-execution functions, allowing potential attackers to run commands through the AI interface. Additionally, insufficient authentication controls create a pathway for remote code execution.

Tool-calling is a critical feature in the exposed Ollama ecosystem. Unlike traditional text-generation endpoints, tool-enabled systems can perform actions. Attackers can craft prompts to manipulate these AI models into executing system commands or accessing files without the server owner's knowledge.

Approximately 22% of exposed hosts feature vision capabilities, enabling them to analyze images and documents. Attackers can exploit this by embedding malicious instructions within image files, facilitating indirect prompt injection attacks that bypass standard security measures.

About 26% of hosts run reasoning-optimized models, enabling them to perform complex tasks in sequential steps. This capability provides attackers with advanced planning potential for multi-stage attacks. Furthermore, nearly 48% of the hosts employ identical quantization formats and model families, creating a monoculture susceptible to widespread exploitation.

This structural vulnerability means that a single flaw can have extensive ramifications across the entire exposed ecosystem, rather than being isolated incidents.

Based on reporting by Cyber Security News.