Hackers Are Quietly Hijacking Exposed AI Servers to Run Their Attacks

Zenity Labs' honeypot sensors caught three separate operators between March and May hijacking exposed Ollama and LiteLLM endpoints to run their own offensive tooling, including one attacker who fed a 140,000-plus-character prompt to the Strix autonomous penetration-testing framework aimed at a French auction site. GreyNoise recorded 91,403 attack sessions against exposed LLM infrastructure between October 2025 and January 2026, including an 11-day campaign starting December 28 that generated 80,469 sessions probing more than 70 LLM endpoints, while researchers tallied over 175,000 publicly reachable Ollama servers across 130 countries, most without authentication. The incidents exploit default configurations — Ollama's port 11434 ships with no login and LiteLLM's proxy on port 4000 binds to all interfaces with authentication off unless manually enabled — and Cloud Security Alliance researchers found attackers weaponized the PraisonAI flaw CVE-2026-44338 within four hours of disclosure.

No password screen, no login prompt, no exploit required. Ollama and LiteLLM will hand over access to anyone who finds the right IP address. Ollama ships with no login screen by default. Neither does LiteLLM, the popular proxy that routes requests to dozens of AI providers. Point a browser at the wrong port on either one and you don't need a password, a stolen credential, or an exploit. You just need the IP address. Security researchers have spent the first ten months of 2026 proving that attackers found this out long before most companies running these tools did. Zenity Labs put real numbers behind it. Between March and May, the firm's honeypot sensors caught three separate operators hijacking exposed Ollama and LiteLLM endpoints and using them as the model backend for their own offensive tooling, according to Zenity's published research. One attacker aimed an autonomous penetration-testing framework called Strix at a French auction site, feeding it a prompt more than 140,000 characters long to strip out its safety refusals. Another pointed a tool called HexStrike AI at Zenity's decoy Ollama instance and handed it more than 150 offensive hacking tools, without even specifying a target first. A third ran an OpenAI Codex agent wearing a jailbroken persona to help with reverse-engineering work. None of them needed to breach anything. They just needed to know that port 11434, Ollama's default, and port 4000, LiteLLM's default, were sitting open on the internet. The scale behind these incidents is bigger than any single honeypot catch suggests. GreyNoise recorded 91,403 attack sessions targeting exposed LLM infrastructure between October 2025 and January 2026, split across two distinct campaigns. The first exploited server-side request forgery flaws in how Ollama pulls models and in Twilio SMS webhook integrations. The second, which started December 28 and ran for 11 days, generated 80,469 attack sessions on its own, with attackers probing more than 70 different LLM endpoints hunting for misconfigurations that would leak access to paid commercial APIs. Separately, cloud security researchers have tallied more than 175,000 publicly reachable Ollama servers spread across 130 countries, the overwhelming majority of them with no authentication turned on at all. The pattern repeats because the defaults encourage it. Ollama was built for a developer running models on their own laptop, not a production fleet facing the internet, so it never shipped with built-in authentication. LiteLLM's proxy binds to all network interfaces out of the box, and the authentication option exists but has to be switched on manually. Teams racing to get a model into production skip that step constantly, especially on private cloud GPU clusters where engineers assume network isolation is doing the job that a password should be doing. Stolen LiteLLM Credentials From March Hack Surface in 153GB Leak https://startupfortune.com/stolen-litellm-credentials-from-march-hack-surface-in-153gb-leak/ CloudSEK's reconstructed archive contains 433,909 files from 2,488 organizations, including Nvidia, AWS, Cisco, Samsung and Siemens, with many credentials still valid five months after the breach. The FBI's July 2 advisory urged immediate rotation of CI/CD secrets and cloud tokens. - stolen liteLLM credentials from march 2026 security breach https://startupfortune.com/stolen-litellm-credentials-from-march-hack-surface-in-153gb-leak/ - LiteLLM PyPI publishing keys compromised by TeamPCP hackers https://startupfortune.com/stolen-litellm-credentials-from-march-hack-surface-in-153gb-leak/ Speed is making this worse, not better. Cloud Security Alliance researchers tracking disclosure-to-exploitation timelines found that for CVE-2026-44338, a flaw in the PraisonAI agent framework, attackers were weaponizing the bug within four hours of public disclosure. Across the inference and agent tooling the group tracked, exploitation on average started roughly seven days before vendors even had a patch ready. That's not a window security teams can close with a quarterly patch cycle. Separately, hundreds of exploitation attempts hit CVE-2026-40217, a critical remote-code-execution flaw in LiteLLM, on the very day the CVE was patched, and the attempts kept coming for six more weeks, ranging from basic reconnaissance to full sandbox-escape payloads, per Zenity's research. None of this requires the sophistication people associate with AI-specific attacks, like poisoned training data or adversarial prompts designed to trick a model's judgment. It's closer to the oldest trick in the book: scan the internet for an open port, walk in, and use whatever compute you find for free. The twist is just that the thing sitting behind the open port is now expensive GPU-backed inference capacity and, increasingly, an agent framework capable of running its own attack tools once it's hijacked. For a startup or any company self-hosting models in 2026, the fix isn't exotic. Put Ollama and LiteLLM instances behind a VPN or an authenticated gateway, don't expose inference ports to the public internet by default, and patch on the assumption that exploitation starts before the patch exists, not after. Frankly, the defaults on these tools were never meant to survive contact with the open internet, and plenty of production deployments are finding that out the hard way. Also read: Barclays will cut 5,000 jobs this year and says AI is why https://startupfortune.com/barclays-will-cut-5000-jobs-this-year-and-says-ai-is-why/ • Mammoth-1 and Elephant-1 Decision Models Review as Base Labs Claims the Top Spot https://startupfortune.com/mammoth-1-and-elephant-1-decision-models-review-as-base-labs-claims-the-top-spot/ • Dow Jones and New York Post press copyright case as Perplexity nears trial https://startupfortune.com/dow-jones-and-new-york-post-press-copyright-case-as-perplexity-nears-trial/ This article is posted in AI News https://startupfortune.com/category/ai/ , check it out for more related stories. Join the discussion Open in the community → https://startupfortune.com/community/ Almost there. Sign in and your reply posts straight away.