A joint investigation by SentinelOne’s SentinelLABS and Censys has uncovered approximately 175,000 publicly accessible Ollama AI server instances spread across 130 countries.
These servers form a largely unmanaged layer of AI infrastructure, operating outside the security guardrails typically enforced by major cloud-based AI platforms.
Over a monitoring period of roughly 293 days, researchers recorded 7.23 million individual observations, highlighting just how widespread and persistent this internet exposure has become.
Infrastructure Geography & Scale
The exposed Ollama servers are distributed worldwide, with particularly high concentrations in China, the United States, Germany, France, South Korea, India, Russia, Singapore, Brazil, and the United Kingdom.
Within this population, researchers identified a core set of around 23,000 servers that remained continuously online and reachable throughout the entire scan period, effectively forming the backbone of this exposed ecosystem.
These hosts span a wide range of environments, including cloud platforms, VPS providers, and residential ISP networks, making visibility, attribution, and governance significantly more difficult.
What Ollama Is — and Why Exposure Happens
Ollama is an open-source framework designed to run large language models (LLMs) locally, whether on personal laptops or dedicated servers.
By default, Ollama binds its service to 127.0.0.1, limiting access to the local machine. However, a simple configuration change that binds the service to a public network interface can make it reachable from anywhere on the internet — often without the operator realizing the security implications.
Security Risks & Threat Vectors
Unauthorized access: Nearly 48% of exposed servers advertise “tool-calling” capabilities, allowing them to execute code, interact with external APIs, and access system resources. When left unauthenticated, this dramatically increases the potential attack surface.
LLMjacking: Publicly exposed AI hosts can be hijacked and abused for activities such as spam generation, disinformation campaigns, cryptocurrency mining, or resale of access, effectively turning victims’ infrastructure into attacker-controlled resources.
Proxy abuse and stealth: Attackers may also leverage these servers as traffic relays, helping obscure the origin of malicious activity and making investigations and attribution far more challenging.
Broader Implications
The findings highlight a growing challenge tied to self-hosted AI deployments. While open-source tools like Ollama provide flexibility and local control, they also introduce a shadow AI infrastructure that often exists outside centralized security, monitoring, and compliance frameworks.
As a result, researchers are calling for self-hosted AI endpoints to be secured like any other internet-facing service, with proper authentication, network controls, monitoring, and ongoing security oversight.
