--- title: "P24: Securing Self-Hosted AI Services" canonical: https://openvapt.com/academy/p24.html html: https://openvapt.com/academy/p24.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P24: Securing Self-Hosted AI Services Why model servers, AI web interfaces, AI dashboards and vector databases are often left open, and how to find and close them from the machine itself. - Level: Practitioner - Time: about 25 minutes - Read first: F2, F3 ## You Will Be Able To - Name the common self-hosted AI services and their default ports. - Explain what an open model server or notebook gives an attacker. - Bind AI services to loopback and publish them only behind authentication. ## A New Kind of Service Teams now run language models, image generators, notebooks and vector databases on their own servers. Many of these tools were built for one person on a laptop, so many ship with no login enabled by default. ## What an Attacker Gains An open model server lets anyone use your computing power, pull or delete models, and sometimes read the documents stored for retrieval. An open notebook or AI cluster dashboard can be worse: it runs code, so reaching it can come close to having a shell on the machine. ## Finding Them Without Touching Them OpenVAPT is designed never to send a prompt or a request to an AI service. It reads the listening sockets the kernel reports and the configuration files on disk, which is often enough to see exposure. NET-AI-001 matches network-reachable sockets with the default ports of these tools. NET-AI-002 reads Jupyter configuration for a blank token or disabled request forgery protection. ## Closing the Door Bind each service to 127.0.0.1. If other people need it, put a reverse proxy with authentication and TLS in front, or reach it through an SSH tunnel or VPN. Testing how a model answers hostile prompts is a separate activity. It needs the owner's permission and its own plan, and OpenVAPT does not do it. ## In Summary Self-hosted AI tools often have no login. Keep them on loopback, publish them only behind authentication, and treat notebooks and dashboards as remote shells. ## Apply It - [NET-AI-001 AI Model Server or Dashboard Reachable From the Network](https://openvapt.com/checks/NET-AI-001.md) (high) - [NET-AI-002 Jupyter Configuration Weakens Authentication](https://openvapt.com/checks/NET-AI-002.md) (high) ## Lab 1. `Run: openvapt demo vulnerable --only NET-AI- --out p24 and read the evidence for each finding.` 2. `Write the one setting that binds Ollama to loopback and the Jupyter command that sets a password.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Why are many self-hosted AI tools risky on a server? - A. They use too much memory - B. Many have no login and assume a single local user - C. They need a GPU - D. They are always out of date - Answer: B. Tools designed for a laptop often trust whoever can reach the port. 2. What does an open Jupyter server give an attacker? - A. Only read access to notebooks - B. The ability to run code as the account that started it - C. Nothing, because notebooks are static - D. Access to the model weights only - Answer: B. Jupyter executes code, so an open server can act much like a remote shell. 3. How does OpenVAPT find exposed AI services? - A. It sends test prompts - B. It reads listening sockets and configuration files on the machine - C. It scans the internet - D. It asks the model about itself - Answer: B. Detection is read-only: sockets from /proc/net and files on disk. 4. What is the safest default bind address for these services? - A. 0.0.0.0 - B. 127.0.0.1 - C. The public IP address - D. Any address with a firewall rule later - Answer: B. Loopback keeps the service on the machine until access is deliberately published. 5. Is testing a model with hostile prompts part of a local self-assessment? - A. Yes, always - B. No, it is a separate activity that needs the owner's permission and its own plan - C. Only for vector databases - D. Only at night - Answer: B. Prompt testing sends input to a live service. It needs its own authorisation and plan. ## Key Terms - Model Server: A program that loads an AI model and answers requests over a network port, such as Ollama or LM Studio. - Vector Database: A database that stores numeric representations of documents for AI search; it often holds copies of private text. - Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts. - Loopback: The network interface that only reaches the same machine: 127.0.0.0/8 for IPv4 and ::1 for IPv6. ## References - [OWASP Top 10 for Large Language Model Applications](https://genai.owasp.org/llm-top-10/) - [Jupyter Server documentation, Security in the Jupyter Server](https://jupyter-server.readthedocs.io/en/latest/operators/security.html) Offline: `openvapt learn P24`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p24.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.