Hackers Are Quietly Hijacking Exposed AI Servers to Run Their Attacks

No password screen, no login prompt, no exploit required. Ollama and LiteLLM will hand over access to anyone who finds the right IP address.

Ollama ships with no login screen by default. Neither does LiteLLM, the popular proxy that routes requests to dozens of AI providers. Point a browser at the wrong port on either one and you don't need a password, a stolen credential, or an exploit. You just need the IP address. Security researchers have spent the first ten months of 2026 proving that attackers found this out long before most companies running these tools did.

Zenity Labs put real numbers behind it. Between March and May, the firm's honeypot sensors caught three separate operators hijacking exposed Ollama and LiteLLM endpoints and using them as the model backend for their own offensive tooling, according to Zenity's published research. One attacker aimed an autonomous penetration-testing framework called Strix at a French auction site, feeding it a prompt more than 140,000 characters long to strip out its safety refusals. Another pointed a tool called HexStrike AI at Zenity's decoy Ollama instance and handed it 150 offensive hacking tools, without even specifying a target first. A third ran an OpenAI Codex agent wearing a jailbroken persona to help with reverse-engineering work. None of them needed to breach anything. They just needed to know that port 11434, Ollama's default, and port 4000, LiteLLM's default, were sitting open on the internet.

The scale behind these incidents is bigger than any single honeypot catch suggests. GreyNoise recorded 91,403 attack sessions targeting exposed LLM infrastructure between October 2025 and January 2026, split across two distinct campaigns. The first exploited server-side request forgery flaws in how Ollama pulls models and in Twilio SMS webhook integrations. The second, which started December 28 and ran for 11 days, generated 80,469 attack sessions on its own, with attackers probing more than 70 different LLM endpoints hunting for misconfigurations that would leak access to paid commercial APIs. Separately, SentinelLABS and Censys identified roughly 175,000 publicly reachable Ollama hosts across 130 countries.

The pattern repeats because the defaults encourage it. Ollama was built for a developer running models on their own laptop, not a production fleet facing the internet, so it never shipped with built-in authentication. LiteLLM's proxy binds to all network interfaces out of the box, and the authentication option exists but has to be switched on manually. Teams racing to get a model into production skip that step constantly, especially on private cloud GPU clusters where engineers assume network isolation is doing the job that a password should be doing.

Speed is making this worse, not better. Cloud Security Alliance researchers tracking disclosure-to-exploitation timelines found that for CVE-2026-44338, a flaw in the PraisonAI agent framework, attackers were weaponizing the bug within four hours of public disclosure. In a separate analysis citing Mandiant's M-Trends 2026, the group said the industry-wide mean time to exploit had fallen to negative seven days, meaning exploitation was beginning before patches were available on average. That's not a window security teams can close with a quarterly patch cycle. Separately, hundreds of exploitation attempts hit CVE-2026-40217, a high-severity remote-code-execution flaw in LiteLLM, on the day its fix shipped, and the attempts continued for nearly six weeks, ranging from basic reconnaissance to full sandbox-escape payloads, per Zenity's research.

None of this requires the sophistication people associate with AI-specific attacks, like poisoned training data or adversarial prompts designed to trick a model's judgment. It's closer to the oldest trick in the book: scan the internet for an open port, walk in, and use whatever compute you find for free. The twist is just that the thing sitting behind the open port is now expensive GPU-backed inference capacity and, increasingly, an agent framework capable of running its own attack tools once it's hijacked.

For a startup or any company self-hosting models in 2026, the fix isn't exotic. Put Ollama and LiteLLM instances behind a VPN or an authenticated gateway, don't expose inference ports to the public internet by default, and patch on the assumption that exploitation starts before the patch exists, not after. Frankly, the defaults on these tools were never meant to survive contact with the open internet, and plenty of production deployments are finding that out the hard way.

Also read: Barclays will cut 5,000 jobs this year and says AI is why • Mammoth-1 and Elephant-1 Decision Models Review as Base Labs Claims the Top Spot • Dow Jones and New York Post press copyright case as Perplexity nears trial

This article is posted in AI News, check it out for more related stories.