Your LLM Servers Are Exposed: Cisco's Shodan Study Reveals Critical Security Gaps

Fri, 05 Sep 2025 16:40:51 +0000

Are your organization’s Large Language Model (LLM) servers broadcasting sensitive information to the entire internet? A new Cisco security study using Shodan search engine data reveals a troubling reality: thousands of Ollama LLM servers are running with misconfigured settings, creating potential entry points for attackers.

The Scale of Exposure

Cisco’s research team discovered numerous Ollama servers - a popular platform for running LLMs locally - exposed to the internet without proper security controls. However, it’s important to understand that Ollama is designed with secure defaults. By default, Ollama binds only to localhost (127.0.0.1), restricting access to the local machine only. The exposures identified by Cisco’s research occur when administrators deliberately override these secure defaults by setting the OLLAMA_HOST environment variable to 0.0.0.0 to enable remote access, but fail to implement proper security measures.

Configuration on Digitaliziran si

Your LLM Servers Are Exposed: Cisco's Shodan Study Reveals Critical Security Gaps

The Scale of Exposure