InfoSecBulletin Cybersecurity for mankind
A joint investigation by SentinelOne SentinelLABS and Censys found that open-source AI deployment has led to a large “unmanaged, publicly accessible AI compute infrastructure” with 175,000 unique Ollama hosts in 130 countries.
These systems operate outside the usual safety and monitoring measures set by platform providers. According to the company, over 30% of these vulnerabilities are in China. The countries with the most infrastructure include the U.S., Germany, France, South Korea, India, Russia, Singapore, Brazil, and the U.K.
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
“Nearly half of observed hosts are configured with tool-calling capabilities that enable them to execute code, access APIs, and interact with external systems, demonstrating the increasing implementation of LLMs into larger system processes,” researchers Gabriel Bernadett-Shapiro and Silas Cutler added.
Ollama is an open-source tool for easily downloading, running, and managing large language models (LLMs) on Windows, macOS, and Linux.
The service defaults to the localhost address 127.0.0[.]1:11434, but you can easily make it public by changing the binding to 0.0.0[.]0 or a public interface.
Ollama and Moltbot (previously Clawdbot) are both hosted locally, creating new security issues since they operate beyond enterprise defenses. Researchers emphasize the need for new methods to differentiate managed and unmanaged AI computing.
Over 48% of the observed hosts offer tool-calling features through their API endpoints, which return metadata about their functionalities. Tool calling lets LLMs connect with external systems, APIs, and databases, enhancing their abilities and providing real-time data.
“Tool-calling capabilities fundamentally alter the threat model. A text-generation endpoint can produce harmful content, but a tool-enabled endpoint can execute privileged operations,” the researchers noted. “When combined with insufficient authentication and network exposure, this creates what we assess to be the highest-severity risk in the ecosystem.”
The analysis has also found hosts supporting various functions, like reasoning and vision, with 201 hosts running unrestricted prompt templates that lack safety measures.
These systems are vulnerable to LLMjacking, where attackers misuse a victim’s LLM resources, forcing them to pay for the damage. This can involve creating spam emails, spreading misinformation, mining cryptocurrency, or selling access to criminals.
A recent Pillar Security report reveals that threat actors are actively exploiting exposed LLM service endpoints in a campaign called Operation Bizarre Bazaar to monetize AI infrastructure.
The results indicate a criminal operation with three parts: searching the internet for unsecured Ollama instances, vLLM servers, and OpenAI-compatible APIs without authentication, testing the response quality, and selling access at lower prices through advertising on silver[.]inc as a Unified LLM API Gateway.
“This end-to-end operation – from reconnaissance to commercial resale – represents the first documented LLMjacking marketplace with complete attribution,” researchers Eilon Cohen and Ariel Fogel said. The operation has been traced to a threat actor named Hecker (aka Sakuya and LiveGamer101).
The decentralized Ollama ecosystem, found in both cloud and residential settings, leads to governance issues and allows for malicious traffic injection through victim networks.
“The residential nature of much of the infrastructure complicates traditional governance and requires new approaches that distinguish between managed cloud deployments and distributed edge infrastructure,” the companies said. “For defenders, the key takeaway is that LLMs are increasingly deployed to the edge to translate instructions into actions. As such, they must be treated with the same authentication, monitoring, and network controls as other externally accessible infrastructure.”
