Securing Self-Hosted AI Services

A New Kind of Service

Teams now run language models, image generators, notebooks and vector databases on their own servers. Many of these tools were built for one person on a laptop, so many ship with no login enabled by default.

What an Attacker Gains

An open model server lets anyone use your computing power, pull or delete models, and sometimes read the documents stored for retrieval.

An open notebook or AI cluster dashboard can be worse: it runs code, so reaching it can come close to having a shell on the machine.

Finding Them Without Touching Them

OpenVAPT is designed never to send a prompt or a request to an AI service. It reads the listening sockets the kernel reports and the configuration files on disk, which is often enough to see exposure.

NET-AI-001 matches network-reachable sockets with the default ports of these tools. NET-AI-002 reads Jupyter configuration for a blank token or disabled request forgery protection.

Closing the Door

Bind each service to 127.0.0.1. If other people need it, put a reverse proxy with authentication and TLS in front, or reach it through an SSH tunnel or VPN.

Testing how a model answers hostile prompts is a separate activity. It needs the owner's permission and its own plan, and OpenVAPT does not do it.

In Summary

Self-hosted AI tools often have no login. Keep them on loopback, publish them only behind authentication, and treat notebooks and dashboards as remote shells.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo vulnerable --only NET-AI- --out p24 and read the evidence for each finding.
2. Write the one setting that binds Ollama to loopback and the Jupyter command that sets a password.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• OWASP Top 10 for Large Language Model Applications
• Jupyter Server documentation, Security in the Jupyter Server

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P24: Securing Self-Hosted AI Services (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p24.html

@misc{openvapt_p24,
  author       = {{OpenVAPT}},
  title        = {{P24: Securing Self-Hosted AI Services}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p24.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}