• Joint research maps 175,000 exposed Ollama hosts across 130 countries operating without authentication or monitoring—creating free compute for adversaries
• Nearly half have tool-calling capabilities that can execute code and access internal systems, turning helpful AI assistants into potential data extraction tools

What if someone could use your computer to generate thousands of phishing emails, create disinformation campaigns, or extract sensitive company data—all without you knowing, and all while you pay the electricity bill?

That’s the reality for approximately 175,000 AI systems currently exposed on the internet, according to new research published by SentinelOne’s SentinelLABS and internet intelligence firm Censys.

After spending nearly 300 days mapping the internet for exposed Ollama hosts—self-hosted AI chatbots that anyone can access and use without authentication—the researchers recorded 7.23 million observations across 130 countries. 

Unlike ChatGPT or Claude, which operate behind login screens with monitoring and safety systems, these self-hosted large language models run wide open: no passwords, no usage tracking, no abuse detection.

Ollama is an open-source framework that lets users run AI models locally on their own computers. By design, it’s meant to be accessible only from the host machine. But exposing it to the public internet requires just a single configuration change—and at scale, those individual decisions have created what researchers describe as an “unmanaged, publicly accessible layer of AI compute infrastructure.”

The always-on core

While many exposed Ollama hosts appear briefly and disappear, a persistent core of approximately 23,000 systems drives most of the activity. These hosts show an average uptime of 87% while actively running multiple AI models.

“These are systems that provide ongoing utility to their operators and, by extension, represent the most attractive and accessible targets for adversaries,” the researchers note.

The infrastructure spans everything from home networks to major cloud platforms. When classified by type, consumer internet service providers account for 56% of hosts. But the picture is more complex—hyperscalers like AWS and Azure account for 32% of hosts, while residential and telecom networks account for another 32%.

Geography tells its own story. In the United States, Virginia—home to massive data centre concentrations—accounts for 18% of all exposed hosts. China shows even tighter clustering: Beijing alone represents 30% of Chinese hosts, with Shanghai and Guangdong adding another 21% combined.

Perhaps most concerning: between 16% and 19% of the infrastructure couldn’t be attributed to any identifiable owner. “Security teams and enforcement authorities can observe activity, but they often cannot identify the responsible party,” the report states.

Your helpful AI assistant, now with system access

The real risk escalates when you look at what these exposed systems can actually do. Over 48% advertise “tool-calling capabilities”—meaning they’re not just generating text, they can execute code, access APIs, and interact with external systems.

Another 22% have vision capabilities, meaning they can process images and documents. When you combine these capabilities, you get systems that can understand complex instructions, plan multi-step operations, and carry them out autonomously.

To understand the threat, consider a company that’s deployed an AI system to help employees find information in internal documents. If that system is exposed to the internet without authentication, an attacker doesn’t need to hack anything in the traditional sense.

They simply ask: “Summarise the project roadmap.” Or “List the configuration files in the documentation.” Or “What API keys are mentioned in the codebase?”

“A model designed to be helpful and lacking authentication mechanisms will comply if its retrieval scope includes the targeted information,” the researchers explain.

The research identified at least 201 hosts running “uncensored” configurations that explicitly remove safety guardrails—though the actual number is likely higher since the methodology could only capture prompts visible through API responses.

Free compute, someone else’s bill

For adversaries, the value proposition is simple: distributed compute resources with no authentication, no usage monitoring, and no billing. The person running the exposed Ollama host pays the electricity bill while the attacker gets free AI processing power.

Major AI platforms like OpenAI and Anthropic have reported that criminal organisations and state-sponsored actors already try to leverage their systems for spam campaigns, phishing content creation, and disinformation networks. Those platforms respond with dedicated security teams, rate limiting, and abuse detection systems.

Exposed Ollama hosts offer no such defences. “An attacker can direct malicious workloads to these hosts at zero marginal cost,” the report notes. For operations requiring volume—generating thousands of phishing emails or creating disinformation at scale—this represents a substantial operational advantage.

A significant portion of exposed hosts sits on residential internet connections, which adds another layer of risk. These IP addresses are generally trusted by internet services as belonging to human users rather than bots. Sophisticated attackers could route malicious traffic through these victim systems, making attacks appear to originate from legitimate households.

Everyone is running the same thing

While the 175,000 hosts are spread across thousands of different networks and countries, they’re overwhelmingly running the same AI models in identical formats. Meta’s Llama consistently ranks first, Alibaba’s Qwen2 second, and Google’s Gemma2 third—with zero variation across different measurement methods.

More revealing is the convergence of a specific technical format called Q4_K_M, which appears on 48% of all exposed hosts. Overall, 72% of hosts use the same 4-bit compression format.

This creates what the researchers call a “monoculture” problem. In agriculture, planting identical crops across vast areas makes them all vulnerable to the same disease. In technology, running identical software configurations means a single vulnerability can affect everyone simultaneously.

“A vulnerability in how specific quantised models handle tokens could affect a substantial portion of the exposed ecosystem simultaneously rather than manifesting as isolated incidents,” the report warns.

The convergence isn’t accidental—it reflects the practical reality of running AI on consumer-grade hardware. Models need to be compressed enough to fit in available memory while remaining capable enough to be useful. The sweet spot happens to be the same for most people.

Who’s responsible?

The research highlights what the authors call a “governance inversion”—a flip of traditional responsibility patterns.

In platform-hosted AI services like ChatGPT, one company controls everything: the infrastructure, the models, the access controls, and the abuse monitoring. If something goes wrong, there’s one entity to contact.

With open-weight AI models, the model developers (Meta, Google, Alibaba) release the weights freely. Anyone can download them, compress them into different formats, and deploy them anywhere—home networks, cloud servers, university systems. The releasing company never sees how or where their models are actually used.

“Accountability diffuses downward into thousands of home networks and server closets, while functional dependency concentrates upward into a handful of model lineages released by a small number of labs,” the researchers write.

This doesn’t make open-weight models inherently dangerous, they emphasise. “The same characteristics that create governance challenges also enable research, innovation, and deployment flexibility that platform-hosted services cannot match.”

But it does mean that security approaches designed for centralised platforms don’t translate. You can’t call a help desk to report abuse. There’s no single switch to flip. Nearly 20% of the exposed infrastructure can’t even be traced to an owner.

The bottom line

For the average person running Ollama at home to experiment with AI, the message is straightforward: if you’ve changed your configuration to make it accessible from anywhere, you’ve also made it accessible to everyone.

For organisations deploying AI systems, the researchers’ recommendation is unambiguous: “LLMs are increasingly deployed to the edge to translate instructions into actions. As such, they must be treated with the same authentication, monitoring, and network controls as other externally accessible infrastructure.”

That means the same basic security hygiene that applies to databases, APIs, and web servers applies to AI systems: authentication required, network access restricted, activity logged and monitored.

The 175,000 exposed Ollama hosts represent what researchers assess as “the early formation of a public compute substrate”—a new layer of internet infrastructure that’s widely distributed, unevenly managed, and only partially visible to those trying to secure it.

It’s resilient because it’s spread across thousands of networks in 130 countries—impossible to shut down through any centralised action. But it’s also fragile, concentrated on a handful of identical model configurations that could all be vulnerable to the same attack technique.

As AI systems gain more capabilities and autonomy, what’s exposed today might become tomorrow’s larger problem—unless the gap between deployment ease and security practice closes considerably faster than it has so far.

Update [Current Date]: In an exclusive interview with AI News, SentinelOne’s Gabriel Bernadett-Shapiro revealed that organisations running exposed Ollama instances should immediately bind services to localhost, implement firewall rules blocking port 11434 externally, or place Ollama behind an authenticated reverse proxy. “If you wouldn’t expose a database or task runner unauthenticated, don’t expose an LLM wired to act like one,” he told AI News. Read the full analysis of how this exposure is reshaping the open-source AI landscape.