Case ollama-vapt-autonomous-attackLLMjackingWorldwide
Hijacked Ollama server used as brain of autonomous hacking pipeline
Sysdig observed an attacker using an unauthenticated Ollama instance as the reasoning engine of a tool that scanned targets, wrote exploits and attempted intrusions.
MediumAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 12, 2026
- Location
- Worldwide
- Target
- Exposed Ollama servers
- Severity
- Medium
- Triggered by
- Unknown attacker developing an offensive tool called VAPT
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Sysdig observed an attacker using an unauthenticated Ollama instance as the reasoning engine of a tool that scanned targets, wrote exploits and attempted intrusions.
Impact: Stolen inference compute; tool fingerprinted services, found vulnerabilities, wrote exploits and extracted credentials against lab ranges and HackTheBox targets; no confirmed real-world victims
Who triggered it
Actor: Unknown attacker developing an offensive tool called VAPT
Attribution: No public attribution; observed by Sysdig Threat Research Team on its honeypot infrastructure
Motive: Free model compute to build and test an autonomous penetration-testing and exploitation tool
How it happened
Attack vector: Unauthenticated Ollama API on port 11434 reachable from the internet used as the LLM backend for a multi-stage exploitation pipeline
Root cause: Ollama ships with no authentication by default and roughly 175,000 instances are publicly exposed
Timeline
- Sysdig observes the VAPT pipeline using its exposed Ollama honeypot as reasoning engine
- Sysdig publishes LLMjacking Evolved research
- Cloud Security Alliance issues research note on the campaign
Response
Sysdig published IOCs and advised keeping self-hosted LLM endpoints off public networks and requiring authentication at a reverse proxy
Current status: Ongoing
Sources (open in a new tab)
- Sysdig sysdig.com
- Cloud Security Alliance labs.cloudsecurityalliance.org
- CyberWire Research Saturday thecyberwire.com
Cite this case
Hijacked Ollama server used as brain of autonomous hacking pipeline. AI Threat Watch, case ollama-vapt-autonomous-attack, Jun 12, 2026. https://aithreat.io/cases/ollama-vapt-autonomous-attack/
Permanent link: https://aithreat.io/cases/ollama-vapt-autonomous-attack/