Case study May 20, 2026
University AI Infrastructure Exposures
NuClide Research, ongoing · Updated 2026-05-20 (Session 26 — Lane B complete)
2,710 confirmed exposures · 71 countries · 10,224 institutions swept · Live globe →
Unauthenticated Ollama, Open WebUI, JupyterHub, and LiteLLM instances discovered on university networks worldwide. Organized by country / state.
Structure
US/, United States, organized by state prefix (e.g.NY-columbia.md)international/CC/, all other countries, grouped by ISO country code
Sub-surveys
| File | Date | Class | Output |
|---|---|---|---|
| edu-llm-infra-sweep-2026-05-19.md | 2026-05-19 | Stage 0 dork-map | 1,584 verified-dork × hostname:.edu; 382 productive dorks (24%); full LLM-tier coverage incl. Jupyter (800), Open WebUI (133), Streamlit :8501 (167), n8n (90), Ollama (87), LiteLLM (35) and more |
Confirmed Findings
| File | Institution | Country/State | Severity | Key Finding |
|---|---|---|---|---|
| NY-columbia.md | Columbia University | US · NY | CRITICAL | Cloud proxy (deepseek-v4-pro) + cred leak (username: seascvn066) |
| CA-ucsb.md | UC Santa Barbara | US · CA | CRITICAL | Auth disabled, open inference, “AI Lab”, macOS user marcos leaked |
| NY-suny-buffalo.md | SUNY Buffalo | US · NY | CRITICAL | Cloud proxy 200 OK confirmed, 26 models, RAG pipeline components |
| NC-duke.md | Duke University | US · NC | HIGH | Agent model with file inspection tools, function-calling, injection surface |
| IN-purdue-northwest.md | Purdue University Northwest | US · IN | CRITICAL | 3 cloud proxies live (200 OK): qwen3-coder-next, gemma4:31b, gpt-oss:20b |
| Keio.md | Keio University | Japan | HIGH | Dual DeepSeek cloud proxy, qwen3.5:122b (75GB) accessible without auth |
| Chulalongkorn.md | Chulalongkorn University | Thailand | HIGH | 3 cloud proxies (DeepSeek, Kimi K2.6, Qwen), cred leak (user: llm) |
| POSTECH.md | POSTECH | South Korea | CRITICAL | 11 nodes, 6 account takeovers, 18+ cloud subs incl. Kimi 1T, DeepSeek 671B, Qwen 480B; bionlinux2 + indians (baseball naming) |
| shiv-nadar.md | Shiv Nadar University | India | CRITICAL | 3-node cluster, 376GB local DeepSeek, 18 cloud subscriptions |
| hanoi.md | Hanoi University | Vietnam | HIGH | 18 cloud proxies, cred leak, Docker container ID leaked as username |
| KTH.md | KTH Royal Institute of Technology | Sweden | HIGH | Dual-node DeepSeek cloud, abliterated Gemma running as root |
| tech-crete-ntua.md | Tech Univ. Crete + NTUA | Greece | HIGH | TechCrete: MiniMax cred leak (user: arian); NTUA: 235.7B model open |
| ON-western-ontario.md | University of Western Ontario | Canada · ON | HIGH | Cloud proxy (deepseek-v4-pro), 9 models including vision-language |
| NY-rit.md | Rochester Institute of Technology | US · NY | CRITICAL | 4 nodes: DGX w/ 18 cloud subs, student machine w/ 2 abliterated QwQ-32B |
| newcastle.md | University of Newcastle | Australia | HIGH | DeepSeek cloud proxy, RAG pipeline (mxbai-embed) |
| armenian-academy.md | IIAP NAS Armenia | Armenia | HIGH | Dual cloud proxy, Docker container ID cred leak |
| JKUAT.md | Jomo Kenyatta University | Kenya | HIGH | Cloud proxy (minimax-m2.7), unauthenticated inference |
| zilina.md | University of Žilina | Slovakia | CRITICAL | Student laptop, 3 free-tier cloud proxies 200 OK: devstral-2:123b, deepseek-v3.1:671b, qwen3-coder:480b |
| brno-vutbr.md | Brno University of Technology | Czech Republic | HIGH | Abliterated Gemma3-27B, Bulgarian GPT, RAG pipeline |
| hertfordshire.md | University of Hertfordshire | UK | CRITICAL | RobotHouse dev server, gpt-oss:latest 200 OK confirmed |
| itmo.md | ITMO University | Russia | HIGH | 24 models incl. Kimi-Dev-72B, Llama4, gpt-oss:20b/120b |
| vnu-hanoi.md | VNU Ha Noi | Vietnam | HIGH | Domain-specific models: legal, biomedical, financial QA |
| vnu-hcmc.md | VNU Ho Chi Minh City | Vietnam | HIGH | final-exploit-v1 cloud proxy, gpt-oss |
| MB-u-manitoba.md | University of Manitoba | Canada · MB | HIGH | CS GPU server, DeepSeek-R1:70B, Llama 3.3 |
| umea.md | Umeå University | Sweden | HIGH | gpuhost02 CS cluster, qwen3.6:35b |
| CA-ucdavis.md | UC Davis | US · CA | HIGH | 75GB MoE model, Claude 4.6 Opus-distilled model |
| yonsei.md | Yonsei University | South Korea | CRITICAL | 17 cloud subs on port 5004, minimax-m2.1 200 OK, 75GB + 65GB local models |
| NY-syracuse.md | Syracuse University (IST R640 + Newhouse ChatEval) | US · NY | CRITICAL (hard-proof) | Original: IST R640 gemma4:31b-cloud 200 OK on port 12345. Wave-2 deeper enum (2026-05-19): Newhouse School newh-eil-01.syr.edu:8080 ChatEval /api/settings/endpoints PUBLIC-unauth → leaks 4 production API keys (OpenAI svcacct + Anthropic + Gemini + Cloudflare Access); 14K-conversation social-engineering research-data exposed |
| NY-suny-stony-brook.md | SUNY Stony Brook | US · NY | HIGH | Biology dept, OLMo-3 research stack, gpt-oss cloud proxy |
| u-crete-medical.md | University of Crete Medical Center | Greece | HIGH | Dual-embedding RAG pipeline (mxbai + nomic-embed) on medical server |
| shandong-med.md | Shandong Medical Graduate School | China | CRITICAL | 376GB local DeepSeek, abliterated R1-Distill, cred leak (user: bowee) |
| ncku.md | National Cheng Kung University | Taiwan | HIGH | nckusoc-3090 cred leak, non-standard port 22222, 8 models |
| ncu-aiden.md | NCU / Oplentia (Chang Gung Univ.) | Taiwan | CRITICAL | Production medical scheduling SaaS (Aiden Assistant) system prompt fully exposed, support contacts, HIS integration |
| fju-medph.md | Fu Jen Catholic University | Taiwan | HIGH | Medical Public Health dept, 75GB MoE + 60GB gpt-oss:120b, RAG pipeline |
| ntu-gpu.md | National Taiwan University | Taiwan | HIGH | GPU cluster g1pc2n108, 11 vision/multimodal models (GLM-OCR, GLM-4.7, LLaVA, MiniCPM-V) |
| krena.md | Kyrgyz Research and Education Network (KRENA) | Kyrgyzstan | HIGH | 433GB GLM-5.1 (744B-a40b), largest local model in sweep, deepseek-v4-pro cloud |
| learn.md | Lanka Education and Research Network | Sri Lanka | HIGH | Cred leak (user: modelserver), deepseek-v4-pro cloud, llama3.2-vision |
| moph.md | Thailand Ministry of Public Health | Thailand | HIGH | Government health ministry, qwen3.6:35b + IBM granite vision |
| cefet-rj.md | CEFET/RJ (Federal Tech Education Center) | Brazil | HIGH | 17 models incl. DeepSeek-R1:70B, custom Brazilian Portuguese fine-tunes (chatbode, mistral-pt) |
| enstinet-nren.md | ENSTINET Egypt NREN | Egypt | HIGH | Port 3005 (non-standard), 3 custom Arabic uncensored HauhauCS-35B models, RAG pipeline, CVE-2025-63389 injection + deletion confirmed |
| lodz-tul.md | Technical University of Łódź | Poland | HIGH | xray02 research node, DeepSeek-R1:32B, lukashabtoch/plutotext-r3-emotional cross-network propagation with CEFET/RJ Brazil |
| comsats.md | COMSATS University | Pakistan | HIGH | MedGemma 27B medical AI + 4B medical AI exposed, Kimi cloud proxy |
| VA-vt.md | Virginia Tech | US · VA | LOW | DHCP workstation (h80adf308), 5 models, no cloud proxy |
| snu.md | Seoul National University | South Korea | CRITICAL | Cloud proxies (devstral-2:123b, deepseek-v3.1:671b) + cred leak (user: node1, SSH pubkey) |
| inha.md | INHA University | South Korea | HIGH | gpt-oss:20b local, dual Nemotron-Cascade 30B, 132GB total |
| monash.md | Monash University | Australia | HIGH | 3-node cluster; 376.7GB DeepSeek V3.1 671B (OOM on current allocation); Kimi + MiniMax cloud proxies; v0.20.2/0.18.3/0.19.0 |
| AB-u-alberta.md | University of Alberta | Canada · AB | HIGH | lula.cs.ualberta.ca; v0.21.1; gpt-oss:120b (65GB, 116.8B params); qwen2.5-coder:32b; Qwen3.6 35B/27B |
| tanet.md | Taiwan Academic Network (TANet) | Taiwan | CRITICAL | 18-node multi-institution cluster, account takeover (name=ollama), 5G security system prompt, 4 cloud proxy nodes |
| jingdong.md | China Unicom / Jingdong Cluster | China | HIGH | 26-node uniform cluster v0.5.10, deepseek-r1:1.5b dominant, RAG pipeline |
| kyungpook.md | Kyungpook National University | South Korea | HIGH | 3-node cluster 155.230.x, qwen3-vl:32b vision-language model |
| ici-bucharest.md | ICI Bucharest (National IT Research Institute) | Romania | CRITICAL | 2 nodes: cloud proxy (DeepSeek + MiniMax), abliterated Qwen2.5-Coder, rdv-bot system prompt exposed, 72B model |
| bdren.md | Bangladesh Research and Education Network (BDREN) | Bangladesh | HIGH | National NREN node, 7 models, unauthenticated inference |
| CA-caltech.md | California Institute of Technology (Caltech) | US · CA | HIGH | yertle.caltech.edu, gpt-oss:120b (116B), dual-embedding RAG pipeline, custom syntax + java models |
| arn.md | Algerian Academic Research Network (ARN) | Algeria | MEDIUM | National research network, v0.9.6 (unpatched), SmolLM2 with live system prompt |
| onpt.md | Office National des Postes et Télécommunications (ONPT) | Morocco | MEDIUM | National PTT/telecom infrastructure node, v0.9.6, 1 model |
| nib.md | India NIB / BSNL National Backbone | India | HIGH | 2 nodes on national backbone (BSNL NIB), qwen2.5-coder:32b + deepseek-coder:6.7b coding cluster |
| iti.md | Informatics and Telematics Institute (ITI/CERTH) | Greece | HIGH | vcl.iti.gr Virtual Compute Lab, Mistral Small 24B, system prompt exposed |
| moec.md | Malaysia Ministry of Education EMISC | Malaysia | HIGH | Government education IT ministry, v0.9.6, unauthenticated inference |
| university-of-indonesia.md | University of Indonesia | Indonesia | CRITICAL | AS3382, Depok; llama3.2:3b; v0.5.4-dirty (pre-0.6.0 ancient build); Open WebUI v0.5.4 auth-on/3000 + raw API open/11434; CVE-2025-63389 confirmed |
| tianjin-cloud-park.md | China Telecom Tianjin Big Data Park | China | HIGH | AS141679; 46-node multi-tenant cluster; v0.5.10 uniform; RAG pipelines (nomic-embed + deepseek-r1:1.5b); aliafshar/gemma3-it-qat-tools:27b; no rDNS; research institute tenants |
| IN-purdue.md | Purdue University (main campus) | US · IN | CRITICAL | n8n.tap.purdue.edu, n8n workflow automation server; v0.12.3; account takeover d3af393f8e4e; deepseek-v4-pro + minimax-m2.7 cloud; AI workflow hijack surface |
| university-of-dhaka.md | University of Dhaka | Bangladesh | CRITICAL | AS137359; coding cluster (codellama×2, qwen2.5-coder×2, deepseek-coder); bge-m3 embedding (RAG); 3 cloud proxies incl. qwen3-coder-next (unreleased); v0.20.5 |
| ME-university-of-maine.md | University of Maine (ECE-Ubuntu-02 + fate2.library) | US · ME | CRITICAL | AS557 Orono; ECE host v0.18.2 with 69GB uncensored 122B + 18 cloud proxies; 2nd host (2026-05-19): fate2.library.umaine.edu v0.23.2 15-model vision-language stack OBSERVED |
| CA-ucla.md | UCLA (IDRE ai.idre.ucla.edu) | US · CA | OBSERVED | Multi-service host: Open WebUI v0.9.1 with enable_signup:true + enable_ldap:true OBSERVED; LiteLLM Proxy v1.83.4 dual-exposed (/openapi.json + /public/providers + cost map PUBLIC unauth on both :8000 uvicorn and :80 nginx-fronted) |
| CA-sdsc.md | San Diego Supercomputer Center | US · CA | OBSERVED | Independent ARIN org (SDSC-Z); compute.cloud.sdsc.edu; Ollama v0.20.4 with 53-model inventory; first entry gemini-3-flash-preview:cloud (Ollama :cloud-suffix cloud-proxy class OBSERVED); llama3.2 loaded in /api/ps |
| MD-umd-college-park.md | University of Maryland College Park | US · MD | OBSERVED | amorgos.umd.edu v0.3.32 (very old) with enable_signup:true OBSERVED; Apache 2.4.58 Ubuntu default-page on :80 alongside the OW :8080 deployment |
| FL-usf.md | University of South Florida (College of Marine Science) | US · FL | OBSERVED | Two JupyterHubs (ocgmod1, manglillo) on marine.usf.edu both auth-enforced; adjacent Prometheus /metrics PUBLIC on manglillo:9090 but EMPTY (default install monitoring itself only — no scrape targets configured) — DOWNGRADED from initial info-disclosure claim after content analysis |
| NY-cornell.md | Cornell University (AAP college) | US · NY | OBSERVED | onepl.aap.cornell.edu Open WebUI v0.6.14 auth-on; enable_signup:false + enable_api_key:true (closed-enrollment with post-auth API-key minting); wave-2 cohort exemplar |
| AZ-arizona.md | University of Arizona (genai.arizona.edu) | US · AZ | OBSERVED | Branded “U of A GenAI” Open WebUI v0.7.2 with U-Arizona OIDC backend; enable_signup:false + enable_api_key:false; properly configured institutional LLM service exemplar; surfaced G5-extension follow-up (visorbishop signature requires substring match on customized title) |
| NY-cooper-union.md | Cooper Union (EE dept kahan.ee.cooper.edu) | US · NY | OBSERVED | Open WebUI v0.9.2 auth-on + LDAP federation; first private engineering school in survey; kahan hostname (mathematician naming convention) |
| CO-red-rocks.md | Red Rocks Community College (datalab02.rrcc.edu) | US · CO | OBSERVED | First community college in the survey; Open WebUI v0.9.2 auth-on + LDAP federation; identical deployment template to Cooper Union (suggests common upstream / vendor) — sector expansion note for K-12 + 2-year college follow-up |
| ME-southern-maine.md | University of Southern Maine (CS dept fleet) | US · ME | OBSERVED | 8-host JupyterHub fleet on cs.usm.maine.edu (wasp/earwig/locust/mosquito/ant/beetle/turing/pascal); all 8 auth-enforced (identical 403 response); institutional-deployment-discipline exemplar |
| IL-depaul.md | DePaul University (multi-host campus pattern) | US · IL | OBSERVED | 20+ port-3000 hosts across employee/student/wireless networks; only 4 are Open WebUI; one (140.192.183.141) verified live auth-on v0.4.7; Stage-0 signup-open host DHCP-rotated; documents campus-wireless service-exposure + port-3000-FP-class patterns |
| GA-georgia-state.md | Georgia State University (gluon.gsu.edu) | US · GA | OBSERVED | Streamlit framework on :8501; default title; app content WebSocket-only / not passively enumerable; wave-2 Streamlit cohort |
| CA-stanford.md | Stanford University (dynamic-IP sr24-* host) | US · CA | OBSERVED | Streamlit framework on :8501 on Stanford’s sr* dynamic-IP wireless/residential pattern; framework confirmed; wave-2 Streamlit cohort |
| WA-uw.md | University of Washington (Civil Engineering) | US · WA | OBSERVED | Streamlit framework on :8501 on ce.washington.edu subdomain; older bundle naming (main.*.js); wave-2 Streamlit cohort |
| IL-uchicago.md | University of Chicago (Streamlit + degraded JupyterHub) | US · IL | OBSERVED | Two-host observation: Streamlit framework on helabserver0.uchicago.edu:8501 (wave-2 Streamlit cohort) + JupyterHub on jupyterhub-dev.grid.uchicago.edu:8000 in 502 Bad Gateway degraded state (OSG-affiliated dev environment) |
| CA-ucsd.md | University of California, San Diego | US · CA | HIGH | AS26397; v0.20.7; qwen3.5:35b, gpt-oss:120b/20b; devstral-2:123b-cloud + deepseek-v3.1:671b-cloud; 67.58.51.111 |
| nccu-taide.md | National Chengchi University | Taiwan | CRITICAL | V100×4 GPU server; v0.11.6; 3× Taiwan national TAIDE models (llama-3-taiwan:70b, Gemma-3-TAIDE-12b-Chat, Llama-3.1-TAIDE-LX-8B-Chat); gpt-oss:120b; CVE-2025-63389 |
| forskningsnettet.md | Forskningsnettet (Danish NREN) | Denmark | HIGH | AS1835 Aalborg; Node B v0.3.0 (2023-era ancient build, 2.5yr unpatched); Node A v0.22.0; gemma3:27b + nemotron3:33b |
| waseda.md | Waseda University | Japan | CRITICAL | tokoko.human.waseda.ac.jp; account takeover name=tokoko (human-chosen); custom deepseek-r1-70b-academic + deepseek-r1-70b-jp research models; qwen3-vl:235b |
| itb.md | Institut Teknologi Bandung | Indonesia | HIGH | LSKK AI Lab; v0.9.2; 22 models incl. 7 custom Indonesian-education fine-tunes (indoedu-e5-base, llama-3.1-8b-indoedu, gemma-3-12b-indoedu) + UAT models; BGE-M3 RAG |
| nthu.md | National Tsing Hua University | Taiwan | HIGH | sd197130.shin34.ab.nthu.edu.tw; v0.22.0; taide-npc:latest (Taiwan national AI as NPC/agent model); qwen3.6:35b |
| binh-duong.md | Binh Duong University / IU Vietnam | Vietnam | CRITICAL | Contabo GmbH VPS (Germany); v0.13.1; account takeover name=372f4fd0a9dd; itu.edu.vn hostname |
| tanet-abliterated-cluster.md | TANet Abliterated Cluster (Unknown Institution) | Taiwan | CRITICAL | 120.126.16.144 TANet Taipei no-rDNS; v0.20.3; gemma4-crack-fixed:latest (custom safety-bypassed) + 2× abliterated HF models + dolphin-llama3 + Yinr/qwen2.5-agi:32b |
| tuke.md | Technical University of Košice (FEI) | Slovakia | HIGH | prometheus.fei.tuke.sk; v0.11.11; 24 models; MedGemma 27B (54GB + 29GB dual quant, system prompt exposed); huihui_ai/Qwen3.6-abliterated:35b; Turkish erurollm; RAG pipeline |
| aua.md | Agricultural University of Athens | Greece | HIGH | afa4pc19.aua.gr; v0.18.2; qwen3:235b-a22b (142GB, 235.1B params); dual-embedding RAG (BGE-M3 + nomic-embed); DeepSeek-R1:32B; Llama3.3:70B |
| kumamoto.md | Kumamoto University (CS Architecture Lab) | Japan | CRITICAL | scorpio.arch.cs.kumamoto-u.ac.jp; v0.12.7; account takeover name=d4659cbf55b2; minimax-m2.7:cloud; SSH pubkey exposed |
| nicosia.md | University of Nicosia / Intercollege | Cyprus | MEDIUM | 82.116.203.130; v0.17.0; deepseek-v4-pro:cloud (disabled at probe); unauthenticated inference |
| rwanda.md | University of Rwanda (College of Education) | Rwanda | MEDIUM | 154.68.72.29; qwen3.5:27b + qwen3.6:27b; first Rwanda finding |
| CA-berkeley.md | UC Berkeley | US · CA | HIGH | lal-99-178.reshall.berkeley.edu; v0.11.10; qwen2.5:32b; residential hall machine publicly exposed |
| CA-berkeley-vllm.md | UC Berkeley (Research Computing) | US · CA | HIGH | vLLM 5-node cluster; Meta-SecAlign-8B + Nemotron-30B; 78.5M prompt tokens processed; /pause admin endpoint unauth; username akshat leaked |
| CA-berkeley-course-ai.md | UC Berkeley (EECS Course AI) | US · CA | HIGH | roar-art.EECS.Berkeley.EDU; FastAPI course AI assistant; unauthenticated memory injection via /api/chat/memory-synopsis; no auth on endpoint |
| ntu-csie-vllm.md | National Taiwan University (CSIE) | Taiwan | HIGH | mvnl-nas.csie.ntu.edu.tw; vLLM 2-engine tensor-parallel; nvidia/Llama-3.3-70B-Instruct-FP8; 237 requests, 450K tokens |
| inha.md | INHA University (updated) | South Korea | HIGH | 2 nodes: Ollama (gpt-oss:20b + Nemotron Cascade) + vLLM 0.8.4 (local-qwen, container, 311 requests, 90% cache hit) |
Discovery Queries (Shodan)
# University Ollama instances
http.html:"Ollama is running" org:"university" → 225 results (2026-05-01)
# University Open WebUI instances
http.html:"Open WebUI" port:3000 org:"university" → 84 results (2026-05-01)Cross-referencing same-IP hits across both queries identifies confirmed auth-bypass hosts (Open WebUI auth + raw Ollama port on same machine).
Methodology
- Pull Shodan hits for university-attributed IPs
- Cross-reference Ollama (11434) and Open WebUI (3000) on same IP
- Probe
/api/configforauth: false - Probe
/api/tagson port 11434 for model inventory + cloud proxy models - Check
/api/showfor system prompts on all models - Cloud proxy: attempt inference → 401 response exposes Ollama Connect creds
Scale (sampled 2026-05-01)
| Query | Count |
|---|---|
| University Ollama (port 11434) | 225 |
| University Open WebUI (port 3000) | 84 |
| Auth disabled (Open WebUI) | ~5–10% of Open WebUI set |
| Raw Ollama open (no Open WebUI auth) | ~30–40% of co-deployed |
| Cloud proxy models in university set | ~10–15% of open Ollama |