Around 175,000 Ollama servers were publicly reachable on the open internet in January 2026, across more than 130 countries, nearly all of them without their owners’ knowledge. Self-hosting a model costs little to start. The shipped defaults expose the API to every network interface. Ollama ships with no authentication of its own. Anything that reaches the port can use the model. Most of the danger gets set at install time, before the model ever runs.
Can Scanners Find a Self-Hosted AI Server?
Scanners found these servers long before their owners thought to look. Cisco researchers ran a Shodan-based experiment in September 2025 and identified over 1,000 exposed Ollama instances within the first 10 minutes of scanning. Of those, 214 answered back with live models, some carrying custom names that identified their owners.
Different scans disagree on the total, from about 1,100 in Cisco’s narrow pass to 200,000 in a July 2025 count by FuzzingLabs. Methodologies differ enough that no single figure counts as definitive.
Most exposures come from one command. Ollama’s own Docker documentation shows the port-publish shorthand -p 11434:11434, which binds the API to every network interface. Rootful Docker then bypasses the ufw firewall rules that operators believe are protecting them. Servers turn up exposed this way even when the setting their owners assume is responsible was never touched. People copy commands to make a new tool work. Closing the port afterwards is a further step that often never happens, leaving a server open on every interface regardless of the firewall rules the operator wrote.
What Happens When Someone Finds Your Server
Plenty of practitioners shrugged when the exposure counts made the news. On that reading the worst case is a stranger using a few cents of your electricity, and the shrug would be reasonable if the reading held.
Sysdig’s threat research team watched something different in June 2026, when an attacker used an exposed Ollama server as the reasoning engine for an autonomous exploitation framework. The first session began at 15:43 UTC on a Friday and ran 8.5 hours, with the victim’s hardware fingerprinting targets and writing working exploits, up through privilege escalation. Two days later the tool returned from three more residential IPs. An open port on an unauthenticated service was the entire entry method. No vulnerability was exploited at any point.
Attackers call the commercial version LLMjacking. The resale market behind it explains why scanning for open ports pays. Operation Bizarre Bazaar, documented between December 2025 and January 2026, ran a marketplace selling access to AI providers at 40 to 60% below list price. One stolen API key bought for $30 was measured generating over $46,000 per day in inference charges on the victim’s account. Microsoft took legal action against a syndicate selling the practice at scale in December 2024.
Because a self-hosted server bills nobody, the intrusion surfaces nowhere. The compute is free to the attacker and invisible to the owner, while the IP address attached to whatever the attacker does with it stays yours.
Is Keeping Ollama Updated Enough?
Patching matters even though it closes only half the gap. Ollama ships with no authentication. The maintainers have declined to add it, leaving every Ollama vulnerability pre-authenticated for anyone who can reach the port.
CVE-2024-37032, disclosed in June 2024, allowed unauthenticated remote code execution as root on Docker installs. A public Metasploit module still delivers the shell in seconds. CVE-2026-7482, disclosed in May 2026, lets a remote attacker read process memory on unpatched servers, and that memory can contain prompts, API keys and other users’ conversation data.
Open WebUI, the most common front end, carries a separate cluster of serious flaws, including an account-takeover chain disclosed in November 2025 and an arbitrary code execution flaw published in May 2026 that ran even when administrators had disabled code execution.
Patch adoption is going poorly as well. Updates are manual and nothing prompts them. An August 2026 sampling of exposed instances found the most common versions were outdated releases, with only 7% running the latest stable build.
The Risks of Downloading Models from Hugging Face
Pickle, the most common serialization format for PyTorch models, executes code while the file loads. The load looks identical to a clean one. Opening a model file is equivalent to running a stranger’s program on your machine. Security researchers have found roughly 100 malicious models on Hugging Face, including one that opened a reverse shell to a hardcoded IP address the moment it was loaded. In February 2025, researchers demonstrated a malicious model that passed Hugging Face’s own pickle scanner by compressing the payload with 7z instead of ZIP. A fake repository impersonating OpenAI later reached the top trending position on the hub with 244,000 downloads in 18 hours.
Namespace hijacking works less visibly. When a model author’s account is deleted, anyone can re-register the name and upload poisoned versions, and dependent projects fetch them automatically.
The safetensors format stores only tensor data with no executable code, and PyTorch 2.6 changed the default loading behavior to refuse arbitrary code execution. Each helps without covering the whole problem. Scanners flag known-bad payloads. Most scanner hits are false positives, and the errors go both ways.
Does Prompt Injection Affect Self-Hosted Models?
Prompt injection ranks first on the OWASP 2025 list of LLM threats, and no foolproof prevention exists, because these models read instructions and data off the same channel. The first documented zero-click injection causing real data exfiltration in a production system arrived in June 2025, when a crafted email made an AI assistant embed internal data in an image link that leaked it on fetch.
Running the model yourself removes a protection. Commercial providers run safety filters and abuse detection that a home stack lacks. When researchers jailbreak-tested one popular open-weight model, harmful prompts succeeded 100% of the time. Building a moderation filter is a separate project that no home guide includes.
Is Self-Hosting AI Cheaper than an API?
Self-hosting is cheaper in some configurations and more expensive in more of them than hobby guides suggest. An RTX 4090 system draws 830 to 945 watts under inference load, which works out to $30 to $52 per month running continuously at average US electricity rates, and more in expensive regions. Power-limiting the card cuts that bill by roughly 40% at a cost of 10% of speed, which is the kind of tuning casual guides skip.
A 750-watt supply paired with that card will shut the machine down mid-inference when spikes pass 900 watts. Cards thermal-throttle above 83 degrees Celsius. Air-cooled rigs under sustained load run louder than a normal conversation, day and night.
Renting the hardware has other failure modes. Forgotten hourly-billed instances run up charges overnight, and marketplace spot instances can be reclaimed with 15 seconds of notice.
Licensing also belongs in the comparison. Meta’s Llama license requires a separate agreement above 700 million monthly users, forbids using outputs to train other models, and excludes EU-domiciled users from the Llama 4 multimodal models. GDPR and HIPAA obligations apply to a home GPU server exactly as they apply to any system holding regulated data.
How to Reduce the Risks If You Self-Host
Hardening a self-hosted model server is free and needs no specialist skill. Keeping the API bound to localhost, putting an authenticating proxy in front of it, and patching on a schedule are ordinary operations work. Preferring safetensors over pickle files closes the model-loading route. The right comparison is a database holding customer records, which describes a self-hosted LLM better than the appliance the install guides imply.
Frequently Asked Questions
Is It Safe to Self-Host an AI Model?
It can be, once the operator changes the shipped defaults, which expose the API to every network interface. Researchers counted about 175,000 publicly exposed Ollama servers in January 2026. Safety comes from binding to localhost, firewalling the port, and putting authentication in front through a reverse proxy.
Is Ollama Secure?
Ollama’s design assumes local use, and its maintainers have declined authentication in a long-open GitHub issue. Security therefore depends on the operator binding it to localhost and fronting it with an authenticating proxy.
What Is LLMjacking?
LLMjacking is the unauthorized use of someone’s AI infrastructure, through stolen cloud API keys or exposed self-hosted servers, leaving the victim paying for compute or hosting abuse. One documented campaign logged about 35,000 attack sessions in two months and resold access at 40 to 60% below list price.
What Port Does Ollama Use, and Should I Block It?
Ollama listens on port 11434, bound to localhost by default. Block it from all external access if you only use it locally, and open it only to a trusted subnet or an authenticating reverse proxy. The Docker shorthand -p 11434:11434 binds every interface and ignores ufw rules under rootful Docker.
Can You Add a Password to Ollama?
Ollama’s API has no built-in authentication, and the standard fix is binding it to localhost with a reverse proxy in front that enforces Basic Auth, an API-key header, or OAuth.
Are Pickle Model Files Dangerous?
Pickle files are dangerous, because Python pickle executes arbitrary code during loading, which makes a poisoned model file a stranger’s script in practice. Prefer safetensors, which stores only tensor data, or load with weights_only set to true, the default since PyTorch 2.6.
Can a Self-Hosted AI Leak My Data?
Yes. Chat interfaces and proxies store every prompt and uploaded document in plain text, and prompt injection can coerce a model into exfiltrating whatever it can reach.
How Much Electricity Does a Home AI GPU Server Use?
An RTX 4090 draws about 575 watts under inference load, roughly 830 to 945 watts for the full system. Running 24/7 at US average rates costs about $30 to $52 per month.
Are Open-Weight Models Like Llama Free for Commercial Use?
Commercial use is allowed under conditions that vary sharply by model. Meta’s Llama license requires a separate agreement above 700 million monthly active users, bans using outputs to train other models, and requires attribution. EU-domiciled users are excluded from Llama 4 multimodal models. Gemma and Mistral models ship under Apache 2.0 with no user caps. The OSI does not consider the Llama license open source.
Is Open WebUI Safe to Expose to the Internet?
Expose it only when it is behind authentication and fully patched. Its disclosed flaws include an account-takeover chain reachable through a malicious model server, and another 2026 flaw ran arbitrary code even with code execution disabled.
