Bleeding Llama: The Ollama CVE That Leaked AI Memory and the Hugging Face Supply Chain Crisis

Two AI security incidents landed within 48 hours in May 2026: “Bleeding Llama,” a critical Ollama vulnerability (CVE-2026-7482, CVSS 9.1) that leaks the entire process memory of unauthenticated model servers, and a fake OpenAI Privacy Filter on Hugging Face that hit #1 trending and infected 244,000+ downloaders with a Rust infostealer. Both prove the same point: the AI supply chain is now the primary attack surface.

Two Major AI Security Incidents in 48 Hours — What Happened and What It Means

In a span of less than 48 hours, the AI security landscape was hit with two significant incidents that should make every security professional pause: a critical remote code execution-class vulnerability in Ollama (the most popular local LLM framework) and a sophisticated supply chain attack on Hugging Face that impersonated OpenAI’s Privacy Filter.

Both incidents expose the growing attack surface of the AI ecosystem — from model serving infrastructure to model distribution platforms. This is the same weaponization of AI infrastructure we’ve tracked all year. Let’s break down exactly what happened, the technical details, and what you need to do about it.

Part 1: “Bleeding Llama” — Ollama CVE-2026-7482 (CVSS 9.1)

What Is Ollama?

Ollama is an open-source framework that lets you run large language models locally on your machine instead of relying on cloud APIs. With over 171,000 GitHub stars and 16,000+ forks, it’s the go-to tool for developers who want to run models like Llama 3, Mistral, and Gemma on their own hardware.

But that popularity comes with a target on its back.

The Vulnerability: CVE-2026-7482

On May 10, 2026, cybersecurity researchers from Cyera disclosed a critical vulnerability tracked as CVE-2026-7482, codenamed “Bleeding Llama.” The technical breakdown:

• CVSS Score: 9.1 (Critical)
• Type: Heap out-of-bounds read
• Location: GGUF model loader in Ollama
• Attack Vector: Remote, unauthenticated
• Impact: Full process memory leak

How the Exploit Works

The vulnerability exists in Ollama’s /api/create endpoint. The attack chain:

1. The attacker sends a specially crafted GGUF model file to Ollama’s API.
2. The malicious GGUF file declares tensor offsets and sizes that exceed the file’s actual length.
3. During the quantization process (in fs/ggml/gguf.go and server/quantization.go), the WriteTo() function reads beyond allocated memory boundaries.
4. This out-of-bounds read dumps the entire process memory back to the attacker.

What makes this particularly dangerous is that Ollama’s API is often exposed on local networks or even publicly for team use. An unauthenticated attacker on the network could extract sensitive data from memory — including prompts, responses, and any credentials loaded into the process.

Who’s Affected?

Cyera estimates that over 300,000 Ollama servers are potentially exposed globally. If you’re running Ollama version before 0.17.1 with the API accessible, you’re vulnerable.

Mitigation

• Update immediately to Ollama 0.17.1 or later.
• Restrict Ollama’s API access to localhost only (avoid binding to 0.0.0.0).
• Use a reverse proxy with authentication in front of Ollama if network exposure is needed.
• Monitor for suspicious /api/create requests in your logs.

Part 2: The Fake OpenAI Privacy Filter on Hugging Face

What Happened

On May 11, 2026, it was revealed that a malicious Hugging Face repository had reached the #1 trending spot on the platform by impersonating OpenAI’s recently released Privacy Filter model.

The real OpenAI Privacy Filter (openai/privacy-filter) was released in April 2026 to detect and redact personally identifiable information (PII) in unstructured text. The malicious copy, hosted as Open-OSS/privacy-filter, used typosquatting — a single character difference in the organization name — to trick users.

The Attack Chain

1. The attacker created a Hugging Face organization called Open-OSS (vs. OpenAI).
2. They published a model called privacy-filter, copying the entire model card description verbatim.
3. The repository shipped a Rust-based infostealer disguised as loader.py.
4. When users downloaded and ran the model, the loader fetched and executed the infostealer on their Windows machines.
5. The repository accumulated 244,000+ downloads before being taken down.

Why This Is Alarming

This isn’t just a random malicious package. It’s a targeted supply chain attack against the AI/ML community with several concerning aspects:

• Trust exploitation: The attacker specifically targeted the trust users place in well-known organizations (OpenAI).
• Platform gaming: The repository reached #1 on Hugging Face’s trending list, giving it massive visibility.
• Scale: 244K downloads means a potentially massive number of compromised machines.
• Timing: The attack was launched right after the legitimate release, capitalizing on search interest.

Lessons for the AI Security Community

1. Verify before you download. Always check the organization name, not just the model name. openai/ vs Open-OSS/ is a subtle but critical difference.
2. Inspect loader scripts. Never blindly run Python files that come with downloaded models. Review loader.py, setup.py, or any execution scripts.
3. Use model scanning tools. Tools like modelscan (from ProtectAI) can detect malicious code in model files.
4. Sandbox execution. Run downloaded models in isolated environments, never on production machines.
5. Platform responsibility. Hugging Face and similar platforms need stronger verification for trending repositories and organization impersonation prevention.

The Two Incidents at a Glance

The Bigger Picture: AI Supply Chain Is the New Battleground

These two incidents, while different in nature, point to the same fundamental truth: the AI ecosystem’s supply chain is becoming the primary attack surface — the logical extension of traditional software supply chain risk.

Traditional software supply chain attacks target package managers (npm, PyPI), build systems, and CI/CD pipelines. AI supply chain attacks add entirely new vectors:

• Model registries (Hugging Face, ModelScope) — where malicious models can hide infostealers, backdoors, or data exfiltration code.
• Model serving frameworks (Ollama, vLLM, TGI) — where vulnerabilities in model loading can expose process memory.
• Fine-tuning datasets — where poisoned data can create backdoored models.
• API endpoints — where model-serving APIs can be exploited for memory leaks or injection attacks.

What Security Teams Should Do Now

1. Inventory your AI infrastructure. Know every model server, model registry account, and AI API endpoint in your environment.
2. Implement model signing and verification. Use tools like Sigstore for model provenance.
3. Network segmentation. Keep model-serving infrastructure isolated, especially Ollama instances.
4. Update aggressively. The Ollama CVE shows that AI framework vulnerabilities can be as critical as any web application flaw.
5. Build AI-specific security policies. Your existing supply chain security policies probably don’t cover model files, GGUF loaders, or Hugging Face repos.

Frequently Asked Questions

Is my Ollama instance vulnerable?

If you’re running Ollama version 0.17.0 or earlier and the API is accessible from your network, yes — CVE-2026-7482 requires no authentication and can dump the server’s entire process memory. Update to 0.17.1 immediately and bind the API to localhost.

I downloaded the fake OpenAI Privacy Filter — what should I do?

Immediately disconnect the affected machine from the network, run a full antivirus/EDR scan, check for unauthorized processes, and change all credentials that may have been stored on the machine. The Rust infostealer targets credentials, browser data, and wallets — consider the machine compromised until proven otherwise.

How can I verify a Hugging Face model is legitimate?

Check the organization name carefully (openai/ vs Open-OSS/), look for the verified badge, review the model card for inconsistencies, inspect any included Python scripts like loader.py, and use model scanning tools such as modelscan before execution.

What’s the CVSS score for CVE-2026-7482?

CVSS 9.1 (Critical). The attack requires no authentication and can leak the entire process memory of the Ollama server. Cyera estimates over 300,000 exposed instances globally.

References

• Cyera — “Bleeding Llama” CVE-2026-7482 disclosure (May 10, 2026)
• Hugging Face — fake OpenAI Privacy Filter takedown (Open-OSS/privacy-filter)
• ProtectAI — modelscan model scanning tool
• Hmmnm — Living Off the LLM: How Attackers Weaponize AI Infrastructure
• Hmmnm — Cybersecurity Threat Briefing May 2026
• Hmmnm — Software Supply Chain Security