4 ms·

175K+ publicly-exposed Ollama AI instances discovered

65 points by heresie-dabord 9mo ago

FloatArtifact 9mo ago
This is a combination problem poor default (listening to all interfaces?) and also IPv6 can be publicly accessible. It's a bit dependent on how this is configured upstream by default, but this is a gotcha compared to IPv4.
- chrisjj 9mo ago
  The article says no, the default is listening to just localhost. Given the instances in question have been deliberately configured to listen on public ports, calling this misconfiguration seems somewhat unjustified.
  - crimsonnoodle58 9mo ago
    Not true for their docker instructions which specify -p 11434:11434 instead of -p 127.0.0.1:11434:11434. [1] Combine that with rootful docker's famous bypass of ufw and you have a publicly exposed ollama, even with a firewall. [2] [1] https://docs.ollama.com/docker https://docs.ollama.com/docker [2] https://github.com/moby/moby/issues/4737 https://github.com/moby/moby/issues/4737
    - deleted 9mo ago
      [deleted]
    - chrisjj 9mo ago
      Ouch. Thanks.
rvz 9mo ago
Nevermind. [0] Nothing to see here. [0] https://news.ycombinator.com/item?id=45116322 https://news.ycombinator.com/item?id=45116322
dfajgljsldkjag 9mo ago
I see this happen all the time when people just want their new toys to work right away. They copy and paste commands from the internet to open up the connection but they forget to put a lock on the door. It is dangerous that so many people run these programs without understanding the basics of how networks work.
- rvz 9mo ago
  Even better. We have those who are openly admitting that they have never written / read a line of code and have no idea on what it does and using AI to deploy "AI tools" without knowing how to secure them. Infosec experts are going to have a great time with collecting lots of money out of this.
meltyness 9mo ago
This is a weakness of docker, a bit, I think. I was rigging this up, myself, and conciscious of the fact that basic docker is "all or none" for container port forwarding because it's for presenting network services, had to dig around with iptables so it'd be similar to binding on localhost. The use case https://github.com/meltyness/tax-pal https://github.com/meltyness/tax-pal The ollama container is fairly easy to deploy, and supports GPU inference through container toolkit. I'd imagine many of these are docker containers. e: i stand corrected, apparently -p of `docker run` can have a binding interface stipulated e2: https://docs.docker.com/engine/containers/run/#exposed-ports https://docs.docker.com/engine/containers/run/#exposed-ports which is not in some docs e3: but it's in the man page ofc
- threecheese 9mo ago
  Out of curiosity, why would you need to wrap the call to an Ollama modelfile in docker? Does the dockerized ollama client provide some benefit, when it’s shelling down to local Ollama instance anyway? (Wrt tax-pal)
  - meltyness 9mo ago
    It's more of a distribution thing for me really. I'm basically using docker as a package manager since they otherwise distribute through one of those ad-hoc shell scripts that I'd prefer to avoid accidentally breaking Debian with somehow. I've built ollama before too, but, I like that I can cleanly rip it out of my system or upgrade it without handing root off to some shell script somewhere I guess. If anyone's gonna bash up my system it oughta be me
    - threecheese 9mo ago
      Makes sense, thank you!
  - cyberax 9mo ago
    I'm using open-webui project to host a Web UI for Ollama, and Ollama itself in Docker containers. It's super-useful, because I don't have to worry about it blowing up stuff on my system with automatic installations.
cyberax 9mo ago
Fun fact! On macOS you can expose privileged ports (<1024) using a regular user account. But ONLY if you don't bind the listening port to any interface. So you try to create a listening port on localhost (e.g. 127.0.0.1:443) under a non-root account you get a permission error. Edit: the thing is, you CAN expose "0.0.0.0:443" without root privileges!
- throwaway314155 9mo ago
  How exactly are the ports "exposed" if they can't be bound to an interface?
  - Zambyte 9mo ago
    Binding to 0.0.0.0 means binding to every interface.
    - throwaway314155 9mo ago
      That bit hadn’t been edited in when I wrote my comment.
- vxxzy 9mo ago
  A feature! Not a bug! Bugs can be undisovered features.
- kristopolous 9mo ago
  it's called a privileged port and it's been like this for decades, on every system, ever. Here's a reference to this "macos feature" from 1995: https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html https://www.w3.org/Daemon/User/Installation/PrivilegedPorts....
  - Zambyte 9mo ago
    https://news.ycombinator.com/item?id=18302380 https://news.ycombinator.com/item?id=18302380
adw 9mo ago
The tool-calling thing here is overblown. When you do "tool calling" with an LLM, all you're doing is having the LLM generate output in a particular format you can parse out of the response; it's then your code's responsibility to run the tools (locally) and stick the results back into the conversation. So that _specific_ part isn't RCE. It's still bad for the nine million other obvious reasons though.
nxobject 9mo ago
Pay for Shodan, folks!
gerdesj 9mo ago
I'm not sure the "journos" from Techradar are too familiar with how networks ... work. IPv4 requires an inbound NAT these days to work at all globally, unless you actually have a machine with a globally routable IP. There will probably be a default deny firewall rule too. I do remember the days before NAT ... IPv6 doesn't require NAT (but prefix translation is available and so is ULA) but again a default deny is likely in force. You do actually have to try quite hard to expose something to the internets. I know this because I do a lot of it. The entire article is just a load of buzz words and basically bollocks. Yes it is possible to expose a system on the internet but it is unlikely that you do it by accident. If I was Sead, I'd go easy on the AI generated cobblers and get a real job.
- alexeiz 9mo ago
  Fear not, we have Clawdbot! (openclaw whatever) You can put your naked ass on the internet in seconds now.
- reactordev 9mo ago
  Fortunately there’s an easy way to check…
vivzkestrel 9mo ago
- you ll be surprised how many OLLAMA API KEYS [you can find here](https://github.com/search?q=%22OLLAMA_API_KEY%22&type=code&p=5 https://github.com/search?q=%22OLLAMA_API_KEY%22&type=code&p...) its 2026 and this technique still works. I wonder if github supports regex search
- driverdan 9mo ago
  I just looked through 2 pages and didn't see any keys, just empty config vars and placeholder values. How many real keys are you actually finding?
  - vivzkestrel 9mo ago
    well i did not use regex earlier but found some AWS keys https://github.com/search?q=%2F%22AWS_(%5Cw%2B)%22%3D%22(%5Cw%7B20%7D)%22%2F&type=code https://github.com/search?q=%2F%22AWS_(%5Cw%2B)%22%3D%22(%5C... these are the same guys that later complain about a 100k$ bill on AWS also this conversation never happened
    - Tiberium 9mo ago
      GitHub sends those keys to Amazon which automatically quarantines them
- kirici 9mo ago
  > I wonder if github supports regex search /it does like this/
kristopolous 9mo ago
I tried a few these ... they are pretty slow. If you are looking for free inference you'd have to be pretty desperate. example: $ OLLAMA_HOST=http://47.101.61.248:9000/ http://47.101.61.248:9000/ ollama run gemma3:27b "outline ww2" Many appear to be proxies. I'm familiar with some "serverless" architectures that do things like this https://www.shodan.io/host/34.255.41.58 https://www.shodan.io/host/34.255.41.58 ... you can see this has a bunch of ollama ports running really really old versions You can pull down "new" manifests but very few ollamas are new enough for decent modern models like glm-4.7-flash. The free tier for the kimi-k2.5:cloud is going to be far more useful then pasting these into you OLLAMA_HOST variable. I think the real headline is: "thousands of slow machines running mediocre small models from last year. Totally open..." Anyways, if codellama:13b is your jam, go wild I guess.
- deleted 9mo ago
  [deleted]
- thehamkercat 9mo ago
  If someone is that desperate looking for free inference, or just for fun openrouter has many free models
  - Imustaskforhelp 9mo ago
    Arcee AI is currently free on openrouter with some really great speeds and no logs/traning from what I can tell while being completely free till end of feb and its a 500B model. There are tons of free inference models. I treid to use gemini flash in aistudio + devstral free for agentic tasks but its now deprecated but when it wasn't, it was a really good setup imo. Now I can use arcee but personally ended up buying a 1 month cheap subscription of kimi after haggling it from 19.99 to 1.49$ for first month (could've haggled more too leading to 0.99$ too but yeaaa)
Ms-J 9mo ago
In my opinion Ollama has become so far off course with their licensing and user hostile features [1] that the only sane options I've come across is using llama.cpp. [1] https://www.glukhov.org/post/2025/09/ollama-enshittification/ https://www.glukhov.org/post/2025/09/ollama-enshittification... To not even be able to disable data being exfiltrated with their automatic updates is terrible behavior.
ActorNightly 9mo ago
https://www.shodan.io/ https://www.shodan.io/ I ironically found out about this website from Mr Robot tv show.

This is a combination problem poor default (listening to all interfaces?) and also IPv6 can be publicly accessible. It's a bit dependent on how this is configured upstream by default, but this is a gotcha compared to IPv4.

chrisjj 9mo ago
The article says no, the default is listening to just localhost. Given the instances in question have been deliberately configured to listen on public ports, calling this misconfiguration seems somewhat unjustified.
- crimsonnoodle58 9mo ago
  Not true for their docker instructions which specify -p 11434:11434 instead of -p 127.0.0.1:11434:11434. [1] Combine that with rootful docker's famous bypass of ufw and you have a publicly exposed ollama, even with a firewall. [2] [1] https://docs.ollama.com/docker https://docs.ollama.com/docker [2] https://github.com/moby/moby/issues/4737 https://github.com/moby/moby/issues/4737
  - deleted 9mo ago
    [deleted]
  - chrisjj 9mo ago
    Ouch. Thanks.

rvz 9mo ago

Nevermind. [0] Nothing to see here. [0] https://news.ycombinator.com/item?id=45116322 https://news.ycombinator.com/item?id=45116322

dfajgljsldkjag 9mo ago

I see this happen all the time when people just want their new toys to work right away. They copy and paste commands from the internet to open up the connection but they forget to put a lock on the door. It is dangerous that so many people run these programs without understanding the basics of how networks work.

rvz 9mo ago
Even better. We have those who are openly admitting that they have never written / read a line of code and have no idea on what it does and using AI to deploy "AI tools" without knowing how to secure them. Infosec experts are going to have a great time with collecting lots of money out of this.

meltyness 9mo ago

This is a weakness of docker, a bit, I think. I was rigging this up, myself, and conciscious of the fact that basic docker is "all or none" for container port forwarding because it's for presenting network services, had to dig around with iptables so it'd be similar to binding on localhost. The use case https://github.com/meltyness/tax-pal https://github.com/meltyness/tax-pal The ollama container is fairly easy to deploy, and supports GPU inference through container toolkit. I'd imagine many of these are docker containers. e: i stand corrected, apparently -p of `docker run` can have a binding interface stipulated e2: https://docs.docker.com/engine/containers/run/#exposed-ports https://docs.docker.com/engine/containers/run/#exposed-ports which is not in some docs e3: but it's in the man page ofc

threecheese 9mo ago
Out of curiosity, why would you need to wrap the call to an Ollama modelfile in docker? Does the dockerized ollama client provide some benefit, when it’s shelling down to local Ollama instance anyway? (Wrt tax-pal)
- meltyness 9mo ago
  It's more of a distribution thing for me really. I'm basically using docker as a package manager since they otherwise distribute through one of those ad-hoc shell scripts that I'd prefer to avoid accidentally breaking Debian with somehow. I've built ollama before too, but, I like that I can cleanly rip it out of my system or upgrade it without handing root off to some shell script somewhere I guess. If anyone's gonna bash up my system it oughta be me
  - threecheese 9mo ago
    Makes sense, thank you!
- cyberax 9mo ago
  I'm using open-webui project to host a Web UI for Ollama, and Ollama itself in Docker containers. It's super-useful, because I don't have to worry about it blowing up stuff on my system with automatic installations.

cyberax 9mo ago

Fun fact! On macOS you can expose privileged ports (<1024) using a regular user account. But ONLY if you don't bind the listening port to any interface. So you try to create a listening port on localhost (e.g. 127.0.0.1:443) under a non-root account you get a permission error. Edit: the thing is, you CAN expose "0.0.0.0:443" without root privileges!

throwaway314155 9mo ago
How exactly are the ports "exposed" if they can't be bound to an interface?
- Zambyte 9mo ago
  Binding to 0.0.0.0 means binding to every interface.
  - throwaway314155 9mo ago
    That bit hadn’t been edited in when I wrote my comment.
vxxzy 9mo ago
A feature! Not a bug! Bugs can be undisovered features.
kristopolous 9mo ago
it's called a privileged port and it's been like this for decades, on every system, ever. Here's a reference to this "macos feature" from 1995: https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html https://www.w3.org/Daemon/User/Installation/PrivilegedPorts....
- Zambyte 9mo ago
  https://news.ycombinator.com/item?id=18302380 https://news.ycombinator.com/item?id=18302380

adw 9mo ago

The tool-calling thing here is overblown. When you do "tool calling" with an LLM, all you're doing is having the LLM generate output in a particular format you can parse out of the response; it's then your code's responsibility to run the tools (locally) and stick the results back into the conversation. So that _specific_ part isn't RCE. It's still bad for the nine million other obvious reasons though.

nxobject 9mo ago

Pay for Shodan, folks!

gerdesj 9mo ago

I'm not sure the "journos" from Techradar are too familiar with how networks ... work. IPv4 requires an inbound NAT these days to work at all globally, unless you actually have a machine with a globally routable IP. There will probably be a default deny firewall rule too. I do remember the days before NAT ... IPv6 doesn't require NAT (but prefix translation is available and so is ULA) but again a default deny is likely in force. You do actually have to try quite hard to expose something to the internets. I know this because I do a lot of it. The entire article is just a load of buzz words and basically bollocks. Yes it is possible to expose a system on the internet but it is unlikely that you do it by accident. If I was Sead, I'd go easy on the AI generated cobblers and get a real job.

alexeiz 9mo ago
Fear not, we have Clawdbot! (openclaw whatever) You can put your naked ass on the internet in seconds now.
reactordev 9mo ago
Fortunately there’s an easy way to check…

vivzkestrel 9mo ago

- you ll be surprised how many OLLAMA API KEYS [you can find here](https://github.com/search?q=%22OLLAMA_API_KEY%22&type=code&p=5 https://github.com/search?q=%22OLLAMA_API_KEY%22&type=code&p...) its 2026 and this technique still works. I wonder if github supports regex search

driverdan 9mo ago
I just looked through 2 pages and didn't see any keys, just empty config vars and placeholder values. How many real keys are you actually finding?
- vivzkestrel 9mo ago
  well i did not use regex earlier but found some AWS keys https://github.com/search?q=%2F%22AWS_(%5Cw%2B)%22%3D%22(%5Cw%7B20%7D)%22%2F&type=code https://github.com/search?q=%2F%22AWS_(%5Cw%2B)%22%3D%22(%5C... these are the same guys that later complain about a 100k$ bill on AWS also this conversation never happened
  - Tiberium 9mo ago
    GitHub sends those keys to Amazon which automatically quarantines them
kirici 9mo ago
> I wonder if github supports regex search /it does like this/

kristopolous 9mo ago

I tried a few these ... they are pretty slow. If you are looking for free inference you'd have to be pretty desperate. example: $ OLLAMA_HOST=http://47.101.61.248:9000/ http://47.101.61.248:9000/ ollama run gemma3:27b "outline ww2" Many appear to be proxies. I'm familiar with some "serverless" architectures that do things like this https://www.shodan.io/host/34.255.41.58 https://www.shodan.io/host/34.255.41.58 ... you can see this has a bunch of ollama ports running really really old versions You can pull down "new" manifests but very few ollamas are new enough for decent modern models like glm-4.7-flash. The free tier for the kimi-k2.5:cloud is going to be far more useful then pasting these into you OLLAMA_HOST variable. I think the real headline is: "thousands of slow machines running mediocre small models from last year. Totally open..." Anyways, if codellama:13b is your jam, go wild I guess.

deleted 9mo ago
[deleted]
thehamkercat 9mo ago
If someone is that desperate looking for free inference, or just for fun openrouter has many free models
- Imustaskforhelp 9mo ago
  Arcee AI is currently free on openrouter with some really great speeds and no logs/traning from what I can tell while being completely free till end of feb and its a 500B model. There are tons of free inference models. I treid to use gemini flash in aistudio + devstral free for agentic tasks but its now deprecated but when it wasn't, it was a really good setup imo. Now I can use arcee but personally ended up buying a 1 month cheap subscription of kimi after haggling it from 19.99 to 1.49$ for first month (could've haggled more too leading to 0.99$ too but yeaaa)

Ms-J 9mo ago

In my opinion Ollama has become so far off course with their licensing and user hostile features [1] that the only sane options I've come across is using llama.cpp. [1] https://www.glukhov.org/post/2025/09/ollama-enshittification/ https://www.glukhov.org/post/2025/09/ollama-enshittification... To not even be able to disable data being exfiltrated with their automatic updates is terrible behavior.

ActorNightly 9mo ago

https://www.shodan.io/ https://www.shodan.io/ I ironically found out about this website from Mr Robot tv show.