The attacks arrived at a model server that had no model.
Ollama security is a reachability question, not a model question.
A honeypot with nothing inside
A honeypot study of exposed LLM infrastructure, posted to arXiv in September 2026, describes Ollure, an emulator of the Ollama API that answers requests with no model loaded behind it.
It is a low and medium interaction instrument, so it accepts what arrives and returns answers shaped like the API while no inference happens at all.
It ran for 84 days across four deployments in cloud and university networks and recorded 290,887 interactions from 2,793 unique source addresses.
Most of that traffic was automated discovery, fingerprinting and model enumeration, which is what any reachable port collects.
The rest is the part worth reading twice. The authors report concrete exploitation attempts against the infrastructure layer and the model layer, including model management abuse, path traversal and server side request forgery probes, remote code execution and cryptocurrency mining payloads, resource exhaustion, prompt injection, information extraction, and tool use aimed at agents.
Very little on that list depends on the target being interesting. A service that answers a documented protocol receives the traffic that protocol attracts, and this one had nothing valuable on the far side.
One caveat before the conclusions. The deployments were deliberately exposed, so the instrument measures what the internet does to a reachable endpoint, not how many production services were breached.
Ollama security is a reachability question
The finding is not that local models are unsafe. It is that an endpoint is judged by the protocol it answers rather than by who owns it, so the same reachability that makes a model useful to your team makes it useful to everyone else scanning the internet.
Consider how these endpoints appear in practice. A developer starts a model on a laptop and binds it to every interface so a colleague can reach it, a GPU host publishes the port for a container, a service object sits behind a load balancer, a tunnel gets opened for a demo, a firewall rule gets relaxed on a Friday.
Each step is reasonable on its own, and none of them adds an identity.
Internal reachability is a scope decision rather than a safety feature. Inside that scope, every compromised laptop, build runner and vendor jump host becomes a caller, and the model cannot tell them apart from your own services.
What makes the gap expensive is the shape of the API. The process that answers a prompt usually manages the models as well: it fetches them, lists them, deletes them, and reads and writes local storage while it works.
When those abilities sit behind no identity, the distance between an inference service and a remote code execution primitive comes down to which route the caller takes.
The prompt injection and information extraction entries in the log point at the second layer of the problem. Anyone who can send the first instruction owns the session, and everything your model can reach becomes something they can ask about.
Tool use aimed at agents extends that reach, because an agent holding tools turns a borrowed prompt into actions.
Three changes worth making
1. Own the port before you own the model. Decide who is allowed to reach the endpoint and make the network enforce it, because an answering socket is a service whether or not you called it one. Where a peer genuinely needs access, terminate the request at an authenticated proxy and keep the model on a loopback or private interface, which is ordinary API security.
2. Treat model management, and the first instruction, as privileged. Fetching, creating and deleting models arrived as its own category of abuse, so the routes that change state deserve stronger identity checks than the routes that answer a prompt. Run the process with the smallest filesystem and network reach it can survive on, and treat the ability to set the opening instruction as an access decision rather than a prompt engineering detail.
3. Meter consumption, not just access. Resource exhaustion and mining payloads are the clearest statement of what is valuable here, which is the compute. GPU saturation, unexpected model pulls and long generations from unfamiliar callers belong in your alerting rather than your capacity planning. The same openness feeds quieter traffic, including the output harvesting that turns a metered API into somebody else's training data.
None of this is free. Authentication puts a credential in every client, including the agents you were trying to enable, and credentials have to be issued, rotated and revoked.
Take the trade deliberately instead of by accident. A token per consumer, a quota per token and a log line that names the caller turn abuse into a billing and behaviour change rather than a surprise.
What the instrumentation cannot tell you
Honeypots flatter themselves. They are placed where they will be found and they answer everything that asks, which makes them good at measuring probes and poor at measuring intent.
Treat the exploitation list as a floor rather than a rate. Four deployments and 84 days describe one instrument, and the fact that most traffic was enumeration says more about how cheap discovery has become than about how often a real intrusion follows.
Source addresses are weak evidence too, since scanners rent and rotate them, so the count of 2,793 says how wide the net was rather than who was casting it.
What survives those caveats is that Ollama security looks like any other exposure problem. Discovery and exploitation arrive through the same door, and the door is a port number rather than a relationship.
Two promises, one control
Running your own model has always been sold as a privacy argument, the claim that the data never leaves the building.
The honeypot separates the two promises. Residency describes where the weights sit, reachability decides who can call them, and only the second one is something you control.
If a colleague's laptop could reach your inference port tomorrow, what would tell you it had been used as somebody else's compute this week?