Unauthenticated AI Inference at Scale: RAG-Layer PII Exfiltration, Financial Fraud Vectors, and Supply Chain Risks in Exposed Ollama Deployments

Abstract

We report on a systematic measurement study of unauthenticated Ollama AI inference servers exposed on the public internet. Using passive enumeration via the Shodan Internet Intelligence Platform, we identify 20,971 publicly accessible Ollama endpoints and more than 54,000 total AI inference services across more than ten backend types, all reachable with no authentication. We conduct targeted proof-of-concept probing against three representative endpoints spanning enterprise cloud, residential broadband, and commercial VPS infrastructure across three countries (USA, Sweden, Austria). All three endpoints score maximum exploitability across five dangerous write operations (model deletion, arbitrary pull, push exfiltration, persistent model poisoning, and clone operations), zero security headers, and zero rate limiting. We document a previously unreported financial fraud vector arising from the proliferation of cloud API proxy models (:cloud suffix), through which unauthenticated access to an Ollama endpoint constitutes direct financial fraud against the endpoint owner's commercial AI API accounts. Extending beyond prior work, we characterize four Retrieval-Augmented Generation (RAG) layer PII exfiltration vectors that require no write access or special knowledge: (1) context-token session hijacking via /api/generate's persistent KV-cache state; (2) cleartext HTTP conversation history re-transmission; (3) co-deployed RAG database exposure; and (4) prompt-based RAG context extraction. In live testing, the fourth vector extracted 11 of 11 PII categories including financial credentials, medical diagnoses, and authentication passwords on the first plain-language prompt against a live production endpoint. We additionally identify a supply chain risk arising from shared model artifact digests across geographically separated endpoints, and a novel operator risk taxonomy distinguishing technically sophisticated but selectively insecure operators from the commonly assumed unaware operator class. All probing used entirely synthetic personal data. No real user conversations were accessed or retained. Responsible disclosure notices were sent to relevant ISPs prior to submission.