OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure
An Ollama API honeypot logged 290,887 interactions, including RCE, mining, and prompt injection.
Researchers present Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM. Over 84 days and four cloud and university deployments, it recorded 290,887 interactions from 2,793 unique source IP addresses. Most activity was automated discovery, fingerprinting, and model enumeration. They also observed model-management abuse, path traversal and SSRF probes, remote-code-execution and cryptomining payloads, resource exhaustion, prompt injection, information extraction, and agent-oriented tool use.
- Ollure emulates the Ollama API without running a backend model.
- Four deployments over 84 days logged 290,887 interactions from 2,793 IPs.
- Most traffic was discovery, fingerprinting, and model enumeration.
- Attempts included RCE, cryptomining, SSRF, path traversal, and prompt injection.
Full article123 words · extracted from arxiv.org · click to collapse
Publicly exposed large language model (LLM) infrastructure creates a growing attack surface, yet real-world targeting remains poorly understood. We present Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM. Spanning four deployments across cloud and university networks, Ollure operated for 84 days and recorded 290,887 interactions from 2,793 unique source IP addresses. Most of the activity consisted of automated discovery, fingerprinting, and model enumeration. However, we also observed concrete exploitation attempts against both the infrastructure and LLM layers. These included model management abuse, path traversal and SSRF probes, RCE and cryptocurrency mining payloads, resource exhaustion attempts, prompt injection, information extraction, and agent-oriented tool use. Our results provide empirical insight into real-world threats against exposed, self-hosted LLM services.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.29757