Measurement reveals exposed Ollama AI model endpoints growing online
Ollama in the Wild: A Longitudinal Measurement of Exposed Ollama LLM Endpoints at Internet Scale
Networking and Internet Architecture
Summary
Ollama is a service for running large language AI models on private servers, but many of these servers are exposed openly on the Internet. The authors studied these exposed servers over a year, tracking how many appeared, where they were located, and whether they kept outdated or vulnerable software versions. They found many such servers persistently exposed, mostly hosted in cloud environments, often running older versions that could be insecure. This shows a common pattern of insecure deployment practices that could be addressed by cloud providers.
What this means in practice
- •For cloud infrastructure teams: Identify and fix recurring insecure deployment patterns in exposed Ollama LLM services hosted on cloud platforms.
- •For network security operators: Monitor exposed LLM endpoints for outdated software versions to prioritize vulnerability patching and reduce attack surfaces.
Authors
Zuyao Xu, Xiang Li, Yuqi Qiu, Lu Sun
Abstract
Self-hosted large language model (LLM) serving is emerging as a distinct category of Internet service, but we still know little about how these deployments appear and change on the public Internet. We present a 365-day longitudinal measurement of exposed Ollama endpoints (port 11434) from February 2025 to February 2026, combining daily active probing with GeoIP/ASN enrichment, PTR and port-443 host observations, and survival analysis. Across 362 observation days and approximately 4.8 million IP$\times$day observations, 26.4% of the 152,137 cumulative IPs appear for a single day; across five selected CVEs, only 0.43-2.90% of below-fix IPs upgraded in place; the top five countries/regions account for over 70% of weighted observations; and cloud and hosting providers dominate the top ASNs. These results characterize exposed Ollama as a structural exposure surface: persistent, growing, and heavily concentrated. At the same time, old versions, common model choices, cloud and hosting ASNs, PTR categories, and TLS certificate patterns remain visible across the year, indicating recurring insecure deployment practices in cloud infrastructure and the potential reach of provider-level mitigation.