Case llama-cpp-slots-prompt-leakModel & data leakWorldwide
Exposed llama.cpp servers leak user prompts through the /slots debug endpoint
UpGuard found about 400 internet-facing llama.cpp servers, a third of which exposed live prompts via the unauthenticated /slots endpoint; 952 messages were collected in a day, including sexual roleplay involving fictional minors.
MediumAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 25, 2025
- Location
- Worldwide
- Target
- Self-hosted llama.cpp inference servers
- Severity
- Medium
- Triggered by
- UpGuard researchers (discovery); operators' misconfiguration
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
UpGuard found about 400 internet-facing llama.cpp servers, a third of which exposed live prompts via the unauthenticated /slots endpoint; 952 messages were collected in a day, including sexual roleplay involving fictional minors.
Impact: Roughly 117 servers leaking user prompts in real time; five of 108 observed scenarios involved sexually explicit content about fictional children; no corporate data found
Who triggered it
Actor: UpGuard researchers (discovery); operators' misconfiguration
Attribution: Exposure found by UpGuard scanning; operators were mostly hobbyists running roleplay chatbots
Motive: Security research into exposed AI infrastructure
How it happened
Attack vector: Anonymous HTTP requests to the /slots and /props endpoints of llama.cpp servers with no authentication
Root cause: Operators enabled the /slots debugging endpoint, which the documentation warns against in production, and exposed servers directly to the internet
Timeline
- UpGuard samples about 400 exposed llama.cpp servers; 117 IPs expose prompts
- UpGuard publishes findings including 952 unique leaked messages across 108 scenarios
Response
UpGuard published guidance to disable /slots and restrict access; AI Incident Database logged the case
Current status: Ongoing
Sources (open in a new tab)
- UpGuard upguard.com
- AI Incident Database incidentdatabase.ai
Cite this case
Exposed llama.cpp servers leak user prompts through the /slots debug endpoint. AI Threat Watch, case llama-cpp-slots-prompt-leak, Jul 25, 2025. https://aithreat.io/cases/llama-cpp-slots-prompt-leak/
Permanent link: https://aithreat.io/cases/llama-cpp-slots-prompt-leak/