How safe is your local AI? Six weak spots, explained simply

1 The app answers anyone who can reach it

In one line: Ollama has no login. Whoever can connect to it can use your models, change them, and use your ollama.com account.

Ollama runs a small server on your computer: a program that waits for other programs to send it messages. It has no login. Anyone who can connect to it can do everything you can: chat with your models, download new ones, delete them, or create a new model with its own instructions. These are ordinary features, listed in Ollama’s own code (routes.go).

What keeps you safe is the address it listens on. Out of the box, Ollama only accepts connections from your own computer, through the special address 127.0.0.1 (config.go). One setting, OLLAMA_HOST, changes that. People often change it on purpose so they can use their model from a phone or a second computer. LM Studio has a switch for the same thing, called Serve on Local Network. Once either is on, everyone on the same Wi-Fi can use your AI. If your router forwards Ollama’s connection point (its “port”) to the internet, everyone online can too.

What I found in Ollama’s code. I read the server code of Ollama 0.40.7 to see exactly what an open port gives away:

• There is no login to turn on. Ollama has a setting called OLLAMA_AUTH, but it only makes the Ollama command-line program sign the requests it sends (client.go). The server never asks for it.
• Its protection against websites switches off. Ollama checks which address each request was sent to, which blocks a known trick where a web page quietly talks to your Ollama (“DNS rebinding”). The code runs this check only while Ollama listens on 127.0.0.1 (routes.go). Open it to the network and the check is skipped.
• Your ollama.com account comes with it. If Ollama is signed in to an ollama.com account (for cloud models or web search), it forwards some requests to ollama.com signed with your computer’s own key, whoever sent them (cloud_proxy.go). Anyone who can reach it can read the account’s name, email and plan, see its usage and balance, run cloud models and web searches on it, and sign your computer out.
• Which websites may talk to it is one setting. By default, only pages served from your own computer and a few kinds of app can read Ollama’s answers in a browser. Each address added to OLLAMA_ORIGINS lets that website do the same (config.go).

What researchers found. This isn’t rare. Three separate studies counted Ollama servers anyone on the internet could use (SentinelLABS and Censys, Cisco, Xu and others, IMC 2026):

2 Older versions have known holes

In one line: Ollama has fixed several serious holes, most of them reached through the same open API, and many servers never get the fix.

Ollama is updated often, and some updates fix security holes. Each published hole gets an ID that starts with “CVE”, and once it’s published anyone can look up how it works.

The two most serious, in plain words:

• Probllama (CVE-2024-37032, fixed in 0.1.34). A request to download a model from a server someone else controls could write files anywhere on the computer, and from there take it over (Wiz).
• Bleeding Llama (CVE-2026-7482, fixed in 0.17.1). Sending a specially built model file made Ollama read memory it shouldn’t, which can hold keys and chats (Cyera, advisory). It uses the “create a model” request from point 1, so it needs only an Ollama that others can reach.

And updates don’t happen by themselves on servers. A year-long study of open Ollama servers (Xu and others, IMC 2026) found that, depending on the hole, only 0.43% to 2.90% of servers running a version with that hole were updated in place.

The newest Ollama when this was written is 0.40.8, released on 21 October 2026.

3 A model file carries more than the model

A model file isn’t only the trained model. It also carries the chat template, which is a small program, plus default settings. Whoever packages the file decides what goes in them, and you never see them unless you go looking.

What I found myself. My measurement turned up two everyday examples:

• Outdated copies. In 9 of 45 model files in Ollama’s library, the template inside is an older version of the maker’s. For example, falcon3’s file matches the maker’s template from 17 December 2024. The next day, the maker published a change called “fix chat_template for tool use”. The file was simply made before it.
• Rewritten instructions. On Hugging Face, the largest public website for sharing AI models, anyone can upload. Two popular custom models there replace the maker’s instructions for using tools with their own wording. They also add a standing instruction about how to answer.

Neither is an attack. But they show that the instructions travelling with a model can change between its maker and your computer, and others have shown that a tampered one can be an attack (see “If you build with AI” below).

4 The layout step can change what the model reads

This is the weak spot I measured, because I couldn’t find anyone who had counted it.

A model learns to read conversations laid out in one exact way: who is speaking, where instructions go, how a tool is described, how a tool’s answer comes back. Its maker publishes the chat template that produces that layout. If the app lays the conversation out differently, the model is reading something it wasn’t trained on. It’s like being handed a familiar form where the boxes have moved.

Does that matter? Researchers have shown that formatting alone, such as which separators and spaces a prompt uses, can move a model’s accuracy by up to 76 percentage points on some tasks (Sclar and others, ICLR 2024). That study used a different kind of prompt, so I tested it directly on one model. Given the maker’s layout instead of Ollama’s, qwen2.5 answered 45 more of 1,240 tool questions correctly: 87.0% instead of 83.4% (the tool test).

{"type": "function", "function": {"name": "get_weather", "description": "Current weather for a city", "parameters": {"type": "object", "properties": {"city": {"type": "string", "description": "City name"}, "unit": {"type": "string", "enum": ["c", "f"]}}, "required": ["city"]}}}

{"type": "function", "function": {get_weather Current weather for a city {object <nil> <nil> [city] {"city":{"type":"string","description":"City name"},"unit":{"type":"string","enum":["c","f"]}}}}}

What I measured, step by step

A model’s chat template is copied twice on its way to the model: into the model file, and then often into Ollama’s own version. The measurement compares all three.

1. I picked the models: the 50 most popular chat models in Ollama’s library and the 30 most downloaded chat models on Hugging Face, as they were on 22 October 2026.
2. I set some aside. For example, some makers never published a template, so there’s nothing to compare against, and five Hugging Face files couldn’t be read at all. That left 65 models: 43 from Ollama’s library and 22 from Hugging Face. The results page lists every model left out and why.
3. I wrote twelve harmless practice conversations. Six of them use tools: a tool list, a tool request and its answer, two requests at once, and so on.
4. I turned each conversation into the text the model reads, three ways, and compared each with the maker’s:

5. I sorted each difference by kind: a tool's answer missing, an instruction added or dropped, tools written in another format, and so on. Changes to spaces, line breaks or the date don't count.

For 41 of the 45 library model files I read, the Ollama step runs Ollama’s own code, so nothing is guessed. For three others, and for the Hugging Face models, it’s a close copy written in Python. The last one, gpt-oss, uses a separate format of Ollama’s that this study doesn’t reproduce, so it isn’t scored. Nor is translategemma, whose maker’s template can’t show a tool conversation. That leaves 43. All of it ran on my local setup with no GPU and no model downloads: the tool reads only the small header of each model file (7.3 MB of a multi-gigabyte file for qwen2.5). How it works explains the method and how it was checked.

What I found

In Ollama’s library, 32 of 43 models read their tool conversations differently from what their maker designed. “Differently” means a change to what the model is told: a tool’s answer missing, an instruction added or dropped, tools described in another format.

In four of the 32, the only change is the order of the fields in a tool’s description. That’s the mildest kind, so here’s the count without them: 28 of 43.

Some of these models weren’t built for tools at all. Counting only the 19 whose maker’s template does show the model a list of tools: 15 of 19 differ, or 11 of 19 without the order-only cases.

Most differences come from Ollama’s own version of the template. In 24 of the 32, the copy inside the model file gives the same conversations as the maker’s, apart from harmless spacing. In 6, the model file already holds an older copy of the maker’s template, and Ollama’s version changes it further. In 2, the model file has no template of its own to compare.

Hugging Face downloads fare better. For all 22 measured here, Ollama used the template inside the file instead of its own. Only 5 differ, and in all 5 the difference is already in the uploaded file. Ollama adds no meaningful change of its own.

A template that looks different can still be fine. In 7 of the Hugging Face models, the template text differs from the maker’s, yet all twelve conversations came out exactly the same. Reading templates side by side doesn’t tell you much. Comparing the text the model actually receives does.

One model, step by step: qwen2.5

qwen2.5 is the fourth most popular chat model in Ollama’s library.

• The model file holds an outdated template. It matches the maker’s template as it was on 18 September 2024. The maker updated it the next day.
• Ollama’s version describes tools in the wrong format, as the figure above shows. The model was trained on JSON. It gets the internal format of Go, the programming language Ollama is written in. This is already reported to Ollama (issue #14601), and fixes have been proposed. The measurement shows how far it reaches: 4 of the 43 library models (qwen2, qwen2.5, qwen2.5-coder and qwen3).
• A popular Hugging Face copy loses a default instruction. In an earlier test of bartowski’s widely used copy of this model, the template inside the file matched the maker’s exactly. But Hugging Face supplies its own Ollama-style template for it, and Ollama uses that one. It leaves out the short default instruction the maker’s template adds when you don’t write one yourself.
• And the layout changes its answers. On 1,240 tool questions from a public benchmark, the same model on the same server got 1,034 right with Ollama’s layout and 1,079 with the maker’s. The biggest gap: with Ollama’s layout it more often called a tool when none fitted the question. Read the tool test.

5 Helpers turn the model’s words into actions

On its own, a model only writes text. Once you connect a helper that can read files, run commands or browse, its text becomes actions on your computer. Two things can then go wrong:

• The model makes a mistake. The layout problems in point 4 make that more likely. In the tool test, qwen2.5 with Ollama’s layout called a tool when none fitted the question 93 times out of 240, against 78 with its maker’s layout.
• The model is misled by what it reads. A web page, an email or a file can contain text written to give the AI orders. The model can’t reliably tell those apart from yours. This is called prompt injection. OWASP, a long-standing security community, lists it as the number one risk for AI applications (OWASP LLM01:2025).

Either way, what the helper can reach is what’s at risk. Project folders often hold a file called .env with passwords and keys in it, or a private key for logging in to servers.

6 Your chats are kept as ordinary files

“Local” means your conversations stay on your computer. It also means they sit on your disk, where anything that can read your files can read them too. What I found myself, going through Ollama’s code and LM Studio’s documentation:

• Ollama in a terminal (a window where you type commands) keeps the last 100 lines you typed in a file called .ollama/history in your home folder, unless you set OLLAMA_NOHISTORY (history.go).
• The Ollama desktop app keeps its chats in a database file in its app folder (app_state.go).
• LM Studio keeps each chat as a file in .lmstudio/conversations in your home folder (LM Studio docs).
• A debugging setting in Ollama, OLLAMA_DEBUG_LOG_REQUESTS, writes the full text of every request to your temp folder (config.go). It’s off unless someone turns it on.

None of this is a fault. But backup and sync tools copy these files like any others, and anyone who uses your account can open them.