{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T19:49:21Z","timestamp":1774554561567,"version":"3.50.1"},"reference-count":70,"publisher":"Association for Computing Machinery (ACM)","issue":"1","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Meas. Anal. Comput. Syst."],"published-print":{"date-parts":[[2026,3,26]]},"abstract":"<jats:p>Large language models (LLMs) are increasingly deployed through open-source and commercial frameworks, enabling individuals and organizations to self-host advanced LLM capabilities. As LLM deployments become prevalent, ensuring their secure and reliable operation has become a critical issue. However, insecure defaults and misconfigurations often expose LLM services to the public internet, posing serious security risks. This study conducted a large-scale empirical investigation of public-facing LLM deployments, focusing on the prevalence of services, exposure characteristics, systemic vulnerabilities, and associated risks. Through internet-wide measurements, we identified 320,102 public-facing LLM services across 15 frameworks and extracted 158 unique API endpoints, categorized into 12 groups based on functionality and security risk. Our analysis found that over 40% of endpoints used plain HTTP, and over 210,000 endpoints lacked valid TLS metadata. API exposure was highly inconsistent: some frameworks, such as Ollama, responded to over 35% of unauthenticated API requests, with about 15% leaking model or system information, while other frameworks implemented stricter controls. We observed widespread use of insecure protocols, poor TLS configurations, and unauthenticated access to critical operations. These security risks, such as model leakage, system compromise, and unauthorized access, are pervasive and highlight the need for a secure-by-default framework and stronger deployment practices.<\/jats:p>","DOI":"10.1145\/3788097","type":"journal-article","created":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T18:49:47Z","timestamp":1774550987000},"page":"1-26","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Mapping the Landscape of LLM Deployment in the Wild: Prevalence, Patterns, and Perils"],"prefix":"10.1145","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-9965-2109","authenticated-orcid":false,"given":"Xinyi","family":"Hou","sequence":"first","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-8083-6445","authenticated-orcid":false,"given":"Jiahao","family":"Han","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8793-5367","authenticated-orcid":false,"given":"Yanjie","family":"Zhao","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3818-3343","authenticated-orcid":false,"given":"Shenao","family":"Wang","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1100-8633","authenticated-orcid":false,"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, Hubei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2026,3,26]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"Alpha Lab of Topsec. 2025. Security Report on Vulnerabilities in Large Language Model Components and Application Threats."},{"key":"e_1_2_1_2_1","unstructured":"Anonymous. 2024. Awesome Free Ollama. https:\/\/freeollama.oneplus1.top."},{"key":"e_1_2_1_3_1","unstructured":"Eduardo Berlanga. 2024. RCE via pickle deserialization (unpickling) in comfyanonymous\/comfyui. https:\/\/huntr.com\/bounties\/fb5dce86-ca63-40aa-9ff9-c38419a79010."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409759"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2405.13401"},{"key":"e_1_2_1_6_1","volume-title":"Why are web ai agents more vulnerable than standalone llms? a security analysis. arXiv preprint arXiv:2502.20383","author":"Fan Chiang Jeffrey Yang","year":"2025","unstructured":"Jeffrey Yang Fan Chiang, Seungjae Lee, Jia-Bin Huang, Furong Huang, and Yizheng Chen. 2025. Why are web ai agents more vulnerable than standalone llms? a security analysis. arXiv preprint arXiv:2502.20383 (2025)."},{"key":"e_1_2_1_7_1","unstructured":"Silicon Cloud. 2025. Silicon Flow. https:\/\/docs.siliconflow.cn\/en\/userguide\/introduction."},{"key":"e_1_2_1_8_1","volume-title":"Fofa: Cyberspace Asset Search Engine. https:\/\/fofa.info\/.","author":"Community White Hat","year":"2024","unstructured":"White Hat Community. 2024. Fofa: Cyberspace Asset Search Engine. https:\/\/fofa.info\/."},{"key":"e_1_2_1_9_1","unstructured":"NextChat Contributors. 2024. NextChat. https:\/\/github.com\/ChatGPTNextWeb."},{"key":"e_1_2_1_10_1","unstructured":"Github Advisory Database. 2024. ComfyUI-Impact-Pack is vulnerable to Path Traversal. https:\/\/github.com\/advisories\/GHSA-6mx8-m8xp-f2vc."},{"key":"e_1_2_1_11_1","unstructured":"DeepSeek-AI. 2025. DeepSeek LLM. https:\/\/github.com\/deepseek-ai."},{"key":"e_1_2_1_12_1","unstructured":"ComfyUI Developers. 2024. ComfyUI. https:\/\/github.com\/comfyanonymous\/ComfyUI."},{"key":"e_1_2_1_13_1","unstructured":"Volcano Engine. 2025. VolcanoArk. https:\/\/www.volcengine.com\/product\/ark."},{"key":"e_1_2_1_14_1","unstructured":"Sead Fadilpa\u0161i\u0107. 2025. Hundreds of LLM servers left exposed online - here's what we know. https:\/\/www.techradar.com\/pro\/security\/hundreds-of-llm-servers-left-exposed-online-heres-what-we-know."},{"key":"e_1_2_1_15_1","volume-title":"OWASP Top 10 for LLM Applications","author":"Foundation OWASP","year":"2025","unstructured":"OWASP Foundation. 2024. OWASP Top 10 for LLM Applications 2025. https:\/\/genai.owasp.org\/resource\/owasp-top-10-for-llm-applications-2025\/."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/BIGDATA59044.2023.10386351"},{"key":"e_1_2_1_17_1","unstructured":"Georgi Gerganov. 2024. llama.cpp. https:\/\/github.com\/ggerganov\/llama.cpp."},{"key":"e_1_2_1_18_1","unstructured":"Elio Biasiotto Giannis Tziakouris. 2025. Detecting Exposed LLM Servers: A Shodan Case Study on Ollama. https:\/\/blogs.cisco.com\/security\/detecting-exposed-llm-servers-shodan-case-study-on-ollama."},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623985"},{"key":"e_1_2_1_20_1","volume-title":"The emerged security and privacy of llm agent: A survey with case studies. arXiv preprint arXiv:2407.19354","author":"He Feng","year":"2024","unstructured":"Feng He, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S Yu. 2024. The emerged security and privacy of llm agent: A survey with case studies. arXiv preprint arXiv:2407.19354 (2024)."},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3695988"},{"key":"e_1_2_1_22_1","volume-title":"What's important here?: Opportunities and challenges of LLM in retrieving information from web interface. R0-FoMo: Robustness of Few-shot and Zero-shot Learning in Large Foundation Models","author":"Huq Faria","year":"2023","unstructured":"Faria Huq, Jeffrey P Bigham, and Nikolas Martelaro. 2023. What's important here?: Opportunities and challenges of LLM in retrieving information from web interface. R0-FoMo: Robustness of Few-shot and Zero-shot Learning in Large Foundation Models (2023)."},{"key":"e_1_2_1_23_1","unstructured":"Anyscale Inc. 2024. Ray Serve. https:\/\/docs.ray.io\/en\/latest\/serve\/index.html."},{"key":"e_1_2_1_24_1","unstructured":"Timur Isachenko and Shamim Bhuiyan. 2024. Generative AI with local LLM. Timur Isachenko."},{"key":"e_1_2_1_25_1","unstructured":"Project Jupyter. 2024. Jupyter Notebook. https:\/\/jupyter.org\/."},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/SC41406.2024.00022"},{"key":"e_1_2_1_27_1","volume-title":"Tom Goldstein, and Micah Goldblum.","author":"Li Ang","year":"2025","unstructured":"Ang Li, Yin Zhou, Vethavikashini Chithrra Raghuram, Tom Goldstein, and Micah Goldblum. 2025. Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks. arXiv preprint arXiv:2502.08586 (2025)."},{"key":"e_1_2_1_28_1","volume-title":"Llm inference serving: Survey of recent advances and opportunities. arXiv preprint arXiv:2407.12391","author":"Li Baolin","year":"2024","unstructured":"Baolin Li, Yankai Jiang, Vijay Gadepally, and Devesh Tiwari. 2024. Llm inference serving: Survey of recent advances and opportunities. arXiv preprint arXiv:2407.12391 (2024)."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2306.05499"},{"key":"e_1_2_1_30_1","unstructured":"Avi Lumelsky. 2024. More Models More ProbLLMs. https:\/\/www.oligo.security\/blog\/more-models-more-probllms."},{"key":"e_1_2_1_31_1","volume-title":"Web LLM Attacks: Unveiling the Future of Cyber Threats. Available at SSRN 5049058","author":"Ali Pour Fazel Mohammad","year":"2024","unstructured":"Fazel Mohammad Ali Pour and Mohammadreza Rashidi. 2024. Web LLM Attacks: Unveiling the Future of Cyber Threats. Available at SSRN 5049058 (2024)."},{"key":"e_1_2_1_32_1","unstructured":"NIST National Vulnerability Database. 2024a. Apache HTTP Server 2.4.29 Vulnerabilities. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-0211."},{"key":"e_1_2_1_33_1","unstructured":"NIST National Vulnerability Database. 2024b. Nginx 1.14.0 Vulnerabilities. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-20372."},{"key":"e_1_2_1_34_1","unstructured":"Nomic-AI. 2024. GPT4All. https:\/\/github.com\/nomic-ai\/gpt4all."},{"key":"e_1_2_1_35_1","unstructured":"NSFOCUS. 2025. Ollama Unauthorized Access Vulnerability Due to Improper Configuration (CNVD-2025-04094). https:\/\/nsfocusglobal.com\/ollama-unauthorized-access-vulnerability-due-to-misconfiguration-cnvd-2025-04094\/."},{"key":"e_1_2_1_36_1","unstructured":"National Vulnerability Database (NVD). 2024a. CVE-2024-37032: Ollama Remote Code Execution Vulnerability. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-37032."},{"key":"e_1_2_1_37_1","unstructured":"National Vulnerability Database (NVD). 2024b. CVE-2024-6707: OpenWebUI Arbitrary File Upload Vulnerability. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-6707."},{"key":"e_1_2_1_38_1","unstructured":"oobabooga. 2024. Text Generation Web UI. https:\/\/github.com\/oobabooga\/text-generation-webui."},{"key":"e_1_2_1_39_1","unstructured":"OpenAI. 2025a. Build leading AI products on OpenAI's platform. https:\/\/openai.com\/api\/."},{"key":"e_1_2_1_40_1","unstructured":"OpenAI. 2025b. Introducing gpt-oss. https:\/\/openai.com\/index\/introducing-gpt-oss\/."},{"key":"e_1_2_1_41_1","unstructured":"OWASP. 2025. OWASP Top Ten Web Application Security Risks. https:\/\/owasp.org\/www-project-top-ten\/."},{"key":"e_1_2_1_42_1","volume-title":"Security Considerations for Large Language Model Use: Implementation Research in Securing LLM-Integrated Applications. Available at SSRN 4962370","author":"Pesati Nikhil","year":"2024","unstructured":"Nikhil Pesati. 2024. Security Considerations for Large Language Model Use: Implementation Research in Securing LLM-Integrated Applications. Available at SSRN 4962370 (2024)."},{"key":"e_1_2_1_43_1","unstructured":"Cosmopolitan Project. 2024. Llamafile. https:\/\/github.com\/Mozilla-Ocho\/llamafile."},{"key":"e_1_2_1_44_1","unstructured":"Sebasti\u00e1n Ram\u00edrez. 2024. FastAPI\/Swagger UI. https:\/\/fastapi.tiangolo.com\/."},{"key":"e_1_2_1_45_1","unstructured":"Elliot Ward Raul Onitza-Klugman Rory McNamara. 2025. Don't Get Too Comfortable: Hacking ComfyUI Through Custom Nodes. https:\/\/labs.snyk.io\/resources\/hacking-comfyui-through-custom-nodes\/."},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2310.10844"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670388"},{"key":"e_1_2_1_48_1","unstructured":"AnythingLLM Team. 2024a. AnythingLLM. https:\/\/github.com\/Mintplex-Labs\/anything-llm."},{"key":"e_1_2_1_49_1","unstructured":"Gradio Team. 2024b. Gradio. https:\/\/www.gradio.app\/."},{"key":"e_1_2_1_50_1","unstructured":"Jan Team. 2024c. Jan. https:\/\/github.com\/janhq\/jan."},{"key":"e_1_2_1_51_1","unstructured":"Ollama Team. 2024d. Ollama. https:\/\/ollama.com."},{"key":"e_1_2_1_52_1","unstructured":"Open WebUI Team. 2024 e. Open WebUI. https:\/\/github.com\/open-webui\/open-webui."},{"key":"e_1_2_1_53_1","unstructured":"UpGuard Team. 2025. Understanding and Securing Exposed Ollama Instances. https:\/\/www.upguard.com\/blog\/understanding-and-securing-exposed-ollama-instances."},{"key":"e_1_2_1_54_1","unstructured":"vLLM Team. 2024. vLLM. https:\/\/github.com\/vllm-project\/vllm."},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1007\/S11704-024-40231-1"},{"key":"e_1_2_1_56_1","volume-title":"Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023","author":"Wei Alexander","year":"2023","unstructured":"Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How Does LLM Safety Training Fail?. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023, Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine (Eds.). http:\/\/papers.nips.cc\/paper_files\/paper\/2023\/hash\/fd6613131889a4b656206c50a8bd7790-Abstract-Conference.html"},{"key":"e_1_2_1_57_1","volume-title":"Wipi: A new web threat for llm-driven web agents. arXiv preprint arXiv:2402.16965","author":"Wu Fangzhou","year":"2024","unstructured":"Fangzhou Wu, Shutong Wu, Yulong Cao, and Chaowei Xiao. 2024a. Wipi: A new web threat for llm-driven web agents. arXiv preprint arXiv:2402.16965 (2024)."},{"key":"e_1_2_1_58_1","volume-title":"A new era in llm security: Exploring security concerns in real-world llm-based systems. arXiv preprint arXiv:2402.18649","author":"Wu Fangzhou","year":"2024","unstructured":"Fangzhou Wu, Ning Zhang, Somesh Jha, Patrick McDaniel, and Chaowei Xiao. 2024b. A new era in llm security: Exploring security concerns in real-world llm-based systems. arXiv preprint arXiv:2402.18649 (2024)."},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241772"},{"key":"e_1_2_1_60_1","unstructured":"Qianqian Xie Dong Li Mengxi Xiao Zihao Jiang Ruoyu Xiang Xiao Zhang Zhengyu Chen Yueru He Weiguang Han Yuzhe Yang et al. 2024. Open-FinLLMs: Open Multimodal Large Language Models for Financial Applications. arXiv preprint arXiv:2408.11878 (2024)."},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.18653\/V1\/2024.FINDINGS-ACL.443"},{"key":"e_1_2_1_62_1","volume-title":"33rd USENIX Security Symposium, USENIX Security 2024","author":"Yan Shenao","year":"2024","unstructured":"Shenao Yan, Shen Wang, Yue Duan, Hanbin Hong, Kiho Lee, Doowon Kim, and Yuan Hong. 2024. An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection. In 33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024, Davide Balzarotti and Wenyuan Xu (Eds.). USENIX Association. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/yan"},{"key":"e_1_2_1_63_1","volume-title":"ControlNET: A Firewall for RAG-based LLM System. arXiv preprint arXiv:2504.09593","author":"Yao Hongwei","year":"2025","unstructured":"Hongwei Yao, Haoran Shi, Yidou Chen, Yixin Jiang, Cong Wang, Zhan Qin, Kui Ren, and Chun Chen. 2025. ControlNET: A Firewall for RAG-based LLM System. arXiv preprint arXiv:2504.09593 (2025)."},{"key":"e_1_2_1_64_1","volume-title":"A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing","author":"Yao Yifan","year":"2024","unstructured":"Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing (2024), 100211."},{"key":"e_1_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2407.04295"},{"key":"e_1_2_1_66_1","first-page":"1849","volume-title":"Instruction Backdoor Attacks Against Customized LLMs. In 33rd USENIX Security Symposium (USENIX Security 24)","author":"Zhang Rui","year":"2024","unstructured":"Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction Backdoor Attacks Against Customized LLMs. In 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 1849-1866. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/zhang-rui"},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2019.00020"},{"key":"e_1_2_1_68_1","doi-asserted-by":"crossref","unstructured":"Shuai Zhao Meihuizi Jia Zhongliang Guo Leilei Gan Xiaoyu Xu Xiaobao Wu Jie Fu Yichao Feng Fengjun Pan and Luu Anh Tuan. 2025a. A Survey of Recent Backdoor Attacks and Defenses in Large Language Models. arXiv:2406.06852 [cs.CR] https:\/\/arxiv.org\/abs\/2406.06852","DOI":"10.36227\/techrxiv.172832726.62863760\/v1"},{"key":"e_1_2_1_69_1","unstructured":"Wayne Xin Zhao Kun Zhou Junyi Li Tianyi Tang Xiaolei Wang Yupeng Hou Yingqian Min Beichen Zhang Junjie Zhang Zican Dong Yifan Du Chen Yang Yushuo Chen Zhipeng Chen Jinhao Jiang Ruiyang Ren Yifan Li Xinyu Tang Zikang Liu Peiyu Liu Jian-Yun Nie and Ji-Rong Wen. 2025b. A Survey of Large Language Models. arXiv:2303.18223 [cs.CL] https:\/\/arxiv.org\/abs\/2303.18223"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2307.15043"}],"container-title":["Proceedings of the ACM on Measurement and Analysis of Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3788097","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T18:52:18Z","timestamp":1774551138000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3788097"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,26]]},"references-count":70,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2026,3,26]]}},"alternative-id":["10.1145\/3788097"],"URL":"https:\/\/doi.org\/10.1145\/3788097","relation":{},"ISSN":["2476-1249"],"issn-type":[{"value":"2476-1249","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,26]]},"assertion":[{"value":"2026-03-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}