[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Using Exposed Ollama APIs to Find DeepSeek Models](/blog/deepseek-adoption) Publish date July 25, 2025 {x} minute read # Using Exposed Ollama APIs to Find DeepSeek Models [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The explosion of AI has led to the creation of tools that make it more accessible, leading to more adoption and more numerous, less sophisticated users. As with cloud computing, that pattern of growth leads to misconfigurations and, ultimately, leaks. One vector for AI leakage is exposed Ollama APIs that allow access to running AI models.  Those exposed APIs create potential information security problems for the models’ owners. Of greater interest at the current moment, however, the metadata about the models, which also provides a gauge for the extent of [DeepSeek adoption as it aims to compete with alternatives like ChatGPT](https://learn.g2.com/deepseek-vs-chatgpt). By examining exposed Ollama APIs, we can see how AI users are already running DeepSeek in the U.S. and around the world. ## Ollama background [Ollama](https://ollama.com/) is a framework that makes it easy to use and interact with AI models. Once a user installs Ollama, they are presented with a storefront of AI models. Ollama then installs and provides an API to interact with those models. In some cases, that API can be exposed to the public internet, making it possible for anyone to interact with those models. As [others have noted before](https://www.reddit.com/r/ollama/comments/1guwg0w/your_ollama_servers_are_so_open_even_my_grandma/), this potential exposure is obviously quite risky. The Ollama API offers endpoints to push, pull, and delete models, putting any data in them at risk. Anonymous users can also make many generation requests to the models, running up the bill for the owner of the cloud computing account. Any [vulnerabilities](https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032) affecting Ollama may be exploited. Unauthenticated APIs exposed to the internet are bad.  Beyond the risks to the data security for the owners of these Ollama installations, exposing their model information provides us with visibility into the adoption of DeepSeek and its geographic distribution. The [U.S. Navy](https://www.cnbc.com/2025/01/28/us-navy-restricts-use-of-deepseek-ai-imperative-to-avoid-using.html), the [state of Texas](https://www.reporternews.com/story/business/technology/2025/01/31/deepseek-rednote-ban-abbott-texas-artificial-intelligence/78093529007/), [NASA](https://www.cnbc.com/2025/01/31/nasa-becomes-latest-federal-agency-to-block-chinas-deepseek.html), and [Italy](https://www.reuters.com/technology/artificial-intelligence/italys-privacy-watchdog-blocks-chinese-ai-app-deepseek-2025-01-30/) have already banned the use of the DeepSeek app out of concerns that it leaks information to the Chinese government. In theory, those concerns would not apply to the open-source models where the code is available for inspection and modification by the person running it. However, users are unlikely to read the code, some [researchers have found dangers in the model itself](https://www.enkryptai.com/blog/deepseek-r1-ai-model-11x-more-likely-to-generate-harmful-content-security-research-finds), and [open-source projects can be backdoors](https://www.spiceworks.com/it-security/cyber-risk-management/news/xz-utils-backdoor-open-source-software-attack/) for threat actors. ## DeepSeek adoption To measure the uptake of DeepSeek models in the U.S. and elsewhere, the UpGuard Research team analyzed the models running on exposed Ollama APIs, all of which reveal their running model names via unauthenticated APIs.  There are currently around seven thousand IPs with exposed Ollama APIs. In less than three months, that number has increased by over 70% since [Laava](https://laava.nl/blog/6-ollama-security) performed a similar survey and found around 4,000 IP addresses with Ollama APIs.  Of the IPs currently exposing Ollama APIs, 700 are running some version of DeepSeek. 334 are running models in the deepseek-v2 family, which have been available for months. 434 are running deepseek-r1, released last week. Those numbers show that DeepSeek had already achieved significant adoption with their v2 family prior to the highly publicized R-1 model and that R-1 is growing far faster than any previous efforts from DeepSeek.  The highest concentration of IPs running one or more versions of DeepSeek is in China (171 IP addresses, or 24.4%). The second highest concentration is in the U.S., with 140 IP addresses, or 20%. Germany has 90 IP addresses, or 12.9%. The remaining IP addresses are distributed more or less evenly, with no other country having more than 5%. The organizations owning those IPs are highly distributed. As mentioned, there are 140 IP addresses in the US are running DeepSeek on exposed Ollama APIs, and those are spread across 74 different organizations without strong concentration, even in cloud providers. These Ollama APIs are running on home or small business internet connections or university networks. These are most likely hobbyist deployments rather than corporate networks, which can be good and bad. If they are exploited, they would have a smaller blast radius, but they are also not subject to security programs (which is likely why they are configured this way in the first place). Home systems are less likely to be high-value targets in themselves but, conversely, are easier to compromise for use in botnets launching future attacks. The deepseek-r1 models are more or less evenly distributed across the available parameter sizes, except for the most costly 671b parameter version. This distribution shows hobbyists' interest in fairly serious computing setups to support the 70 billion parameter version found in 75 IP addresses. ## Indicators of compromise In surveying exposed Ollama APIs, we observed some IPs with evidence of tampering. Whatever models were running have been replaced with one named “takeCareOfYourServer/ollama\_is\_being\_exposed.” Based on past experience with similarly removed content from exposed databases and cloud storage buckets, this is most likely someone trying to help rather than a threat actor. (Ransom notes are not subtle and usually not so polite). Still, the theoretical risk of exposed models being downloaded, modified, or deleted is very real. These models and any data in them are at the mercy of the internet.  ## Conclusion AI is everywhere, and [individuals are adopting shadow AI](https://www.upguard.com/blog/unmasking-shadow-ai) even faster. UpGuard has more research coming out soon on this topic and our scanning engine already identifies which companies mention or use AI. Within days of the release of deepseek-r1, you could find it on misconfigured servers worldwide and almost certainly running in far more environments that we can’t observe through Ollama APIs. Auditing one’s own attack surface and vendors for exposed Ollama APIs is the first step to prevent the most egregious form of AI data leakage. Beyond that, though, there are more questions to ask. As AI becomes a point of international competition, knowing which models or [AI products your vendors](https://www.upguard.com/blog/detecting-ai-in-the-software-supply-chain) use will need to be part of your third-party risk management program.  eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 22, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)