Malware PoeLLM infects 3,000 servers by exploring open source AI failures like LiteLLM and Ollama

Security researchers identified malware PoeLLM, which has infected more than 3,000 servers by exploring vulnerable and exposed versions of open source AI tools, such as LiteLLM and Ollama. According to [The Register] (https://www.theregister.com/security/2026/10/07/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers/5301672), the attack also hit Gotenberg and Gitea facilities and may have reached commercial software Ivanti Sentry. It is another chapter of a problem that has been repeating itself in recent months: the infrastructure that supports AI applications has become a preferred target.

What does PoellM malware exploit in practice?

The vector is not a sophisticated zero-day in a language model. PoeLLM takes advantage of popular software facilities that have been outdated or displayed directly on the internet without authentication or firewall in front. LiteLLM, a proxy that route calls between different models, and Ollama, used to run LLMs locally, are massive tools for use precisely because they are easy to climb — and it is this facility that turns into a loophole when no one reviews the configuration after the deploy. The name of malware is a pun with poetry, exploited by The Register's own cover.

Which open source AI tools have been hit by PoeLLM?

In addition to LiteLLM and Ollama, researchers point out Gotenberg facilities, aimed at document conversion, and Gitea, used to host Git repositories. There is also the possibility that Ivanti Sentry, a gateway commercial product, has been achieved. The mixture shows that the problem is not "AI security" in the strict sense: it is the safety of all plumbing around it. Those who compromise a document conversion server or an internal repository gain access to data and credentials that feed the AI pipelines — not just the model.

How does PoellM connect to attacks on the AI supply chain?

PoellM is not an isolated point. The portal has already covered the Mini Shai-Hulud attack, which committed hundreds of open source packages, the exploitation of a critical vulnerability in LiteLLM soon after public disclosure and malicious AI agents planted in repositories. The method difference is what makes PoeLLM relevant: instead of poisoning the code that developers download, it attacks the instance that is already running. This means that fixing the package does not solve itself — the adjustment needs to happen in server configuration and monitoring.

What changes to Brazilian teams running IA open source itself?

Most Brazilian teams that use LiteLLM or Ollama do this in VPS and cloud machines, often in a test environment that ended up "turning production". Three checks are immediate: check the installed version against maintainers' notices, restrict network access (no door open to the entire internet) and require authentication before any inference endpoint. It is worth remembering that if one of these servers leaks promises, logs or customer documents, LGPD provides for reporting of incidents that may pose a relevant risk to the owners — which turns a carelessness of configuration into a legal obligation.

What is not yet known about PoellM malware

The number of 3,000 servers is the total reported so far, but the researchers have not detailed the geographical distribution of the victims, which specific versions have been explored or if there has been data exfiltration. Ivanti Sentry's participation appears as a possibility, not as a confirmation. Until these points are clarified, the practical recommendation is to treat any exposed instance of LiteLLM, Ollama, Gotenberg or Gitea as potentially compromised and review access logs before assuming that everything is okay.

Frequently Asked Questions about PoellM malware

What is PoellM malware?

It is a malware that infects servers exploring vulnerable and exposed versions of open source tools, including LiteLLM and Ollama, according to The Register. Over 3,000 machines would have been hit by now.

If I spin Ollama or LitellM locally, am I at risk?

Only if the instance is accessible via the internet or outdated. Isolated internal network environments with corrected version have much less exposure — the way is to restrict doors, require authentication and upgrade.

Does using only commercial AI APIs eliminate the problem?

Nope. The attack shows that the risk is in the plumbing around the AI — proxies, document servers and repositories — which often remains self-hosted even when the model comes from an external provider.