Research demo
175,000 publicly exposed Ollama hosts, nearly half advertising tool-calling
AIR-2026-0022 AIR record · 2026-01-sentinelone-censys-ollama-exposure
From the supporting source
Over 48% of observed hosts advertise tool-calling capabilities via their API endpoints.sentinelone.com
The record
Disclosed
2026-01-29
Vendor
Ollama
Product
Ollama
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target (contested) — a measurement of exposed Ollama hosts; nothing acted and nobody was harmed
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Internet wide scanning
Impact type
Exposure, Potential code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
175,108 unique hosts across 130 countries; 7.23 million observations; ~201 hosts running explicitly uncensored prompt templates
Capability abused
Taxonomy & references
Curator notes
Measurement study by SentinelLABS with Censys, not an incident - class research_demo and impact_realized false. It matters here because it sizes the target surface that NadMesh and LLMjacking actually monetise, and because tool-calling turns an exposed text endpoint into an exposed action endpoint. The Hacker News writeup additionally attributes an 'Operation Bizarre Bazaar' LLMjacking marketplace to this research; that name does not appear in the SentinelLABS post cited here, so that claim is unverified.
Supporting sources
Cite as
Enkrypt AI. "175,000 publicly exposed Ollama hosts, nearly half advertising tool-calling". AIR, AIR-2026-0022. https://agentincident.vercel.app/i/AIR-2026-0022/ (accessed 2026-10-19).