For Teachers · Back to the Module · Print with your browser's Print command.

P24 Teacher Answer Key: Securing Self-Hosted AI Services

Teacher Answer Key (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F2, F3

Learning Objectives

• [ ] Name the common self-hosted AI services and their default ports.
• [ ] Explain what an open model server or notebook gives an attacker.
• [ ] Bind AI services to loopback and publish them only behind authentication.

Key Terms

Write each definition in your own words.

• Model Server: A program that loads an AI model and answers requests over a network port, such as Ollama or LM Studio.
• Vector Database: A database that stores numeric representations of documents for AI search; it often holds copies of private text.
• Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts.
• Loopback: The network interface that only reaches the same machine: 127.0.0.0/8 for IPv4 and ::1 for IPv6.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo vulnerable --only NET-AI- --out p24 and read the evidence for each finding.
2. Write the one setting that binds Ollama to loopback and the Jupyter command that sets a password.

Self-Check Questions

1. Why are many self-hosted AI tools risky on a server?

• [ ] a) They use too much memory
• [x] b) Many have no login and assume a single local user
• [ ] c) They need a GPU
• [ ] d) They are always out of date
• Answer: b. Tools designed for a laptop often trust whoever can reach the port.

1. What does an open Jupyter server give an attacker?

• [ ] a) Only read access to notebooks
• [x] b) The ability to run code as the account that started it
• [ ] c) Nothing, because notebooks are static
• [ ] d) Access to the model weights only
• Answer: b. Jupyter executes code, so an open server can act much like a remote shell.

1. How does OpenVAPT find exposed AI services?

• [ ] a) It sends test prompts
• [x] b) It reads listening sockets and configuration files on the machine
• [ ] c) It scans the internet
• [ ] d) It asks the model about itself
• Answer: b. Detection is read-only: sockets from /proc/net and files on disk.

1. What is the safest default bind address for these services?

• [ ] a) 0.0.0.0
• [x] b) 127.0.0.1
• [ ] c) The public IP address
• [ ] d) Any address with a firewall rule later
• Answer: b. Loopback keeps the service on the machine until access is deliberately published.

1. Is testing a model with hostile prompts part of a local self-assessment?

• [ ] a) Yes, always
• [x] b) No, it is a separate activity that needs the owner's permission and its own plan
• [ ] c) Only for vector databases
• [ ] d) Only at night
• Answer: b. Prompt testing sends input to a live service. It needs its own authorisation and plan.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Top 10 for Large Language Model Applications: https://genai.owasp.org/llm-top-10/
• Jupyter Server documentation, Security in the Jupyter Server: https://jupyter-server.readthedocs.io/en/latest/operators/security.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.