University AI Infrastructure Exposure: Global Overview

NuClide Research · Updated 2026-05-20

Scale

Full sweep of all 10,224 recognized universities worldwide (Hipo dataset, 202 countries). Two lanes ran:

• Lane A (academic TLD sweep — .edu / .ac.* / .edu.* × 1,584 verified Shodan dorks): 831 hosts → 478 confirmed platforms → 742 findings / 40 countries
• Lane B (per-institution hostname:<domain> port-filter — all 10,224): 15,985 hosts verified → 1,970 confirmed platforms → 1,970 findings / 55 countries
• Merged total: 2,710 confirmed exposures across 71 countries / 206 institutions

Live globe: nuclide-research.com/map/universities/ — anonymized public feed, 71-country dot map, per-finding explainers.

Classes: JupyterHub auth-enforced (1,964) · JupyterHub info-public (170) · Open WebUI (33) · Ollama unauth (30+) · Jupyter Server (29) · signup-open (21) · LLMjacking cloud-proxy (16) · Streamlit (7) · LiteLLM openapi-public (2)

Confirmed Exposures by Severity

CRITICAL: Cloud Proxy Live (200 OK)

Direct quota drain at operator expense, no authentication:

CRITICAL: Auth Disabled

Open inference for any internet actor:

CRITICAL: Cloud Proxy + Credential Leak

Operator API credentials (SSH pubkey + username) in 401 response:

HIGH: Large Cloud Proxy Portfolio (No 200 OK, No Cred Leak)

Abliterated / Uncensored Models on University Servers

Safety fine-tuning removed by design. Accessible to unauthenticated callers:

Agentic Models with Tool Execution

Largest Deployments

Geographic Coverage

Attack Patterns Documented

1. Open WebUI auth bypass: UI auth on port 3000 does not protect raw Ollama on port 11434
2. Cloud proxy quota drain: Free-tier cloud models (gemma4-cloud, gpt-oss-cloud, qwen3-coder-next-cloud) return 200 OK without credentials
3. Credential leak via 401: Ollama Connect username + SSH pubkey in 401 error response body
4. Docker binding misconfig: -p 11434:11434 binds to 0.0.0.0 by default
5. Agent model injection: File inspection agents injectable via CVE-2025-63389
6. RAG pipeline injection: Embedding models signal active RAG pipelines; injection affects document-augmented responses
7. Production SaaS system prompt extraction: /api/show returns full system prompt, for commercial AI assistants this leaks business logic, PII collection schemas, function-call formats, and anti-injection rules (see Aiden Assistant @ NCU/Taiwan, rdv-bot @ emails-pro.fr/Romania)
8. 18-subscription cloud bundle: Identical 18-model cloud subscription portfolio (DeepSeek + MiniMax + Kimi + GLM + Qwen + Gemini + Nemotron) appears across POSTECH, Shiv Nadar, Hanoi, RIT, Yonsei, suggests shared institutional license or demo account
9. Non-standard ports: Ollama found on 5004 (Yonsei), 3005 (ENSTINET Egypt), 12345 (Syracuse), 22222 (NCKU SOC), defenders relying on default-port-only filtering miss these
10. Cross-border hosting attribution: Operator country (e.g., France) ≠ host country (e.g., Romania), IP-based reputation tagging misleads
11. Uncensored Arabic-language models: Custom Qwen3.5-MoE fine-tunes with system prompts explicitly disabling content restrictions deployed on NREN infrastructure (ENSTINET Egypt)
12. CVE-2025-63389 persistent impact: Model deletion via /api/delete is confirmed writable; injected system prompt layers persist in blob cache making full restoration non-trivial after attack
13. Cross-institutional model propagation: Identical low-citation community fine-tunes (lukashabtoch/plutotext-r3-emotional, mattw/pygmalion) appear on geographically unrelated institutions, operator social networks or shared Hugging Face download patterns create attribution pivot points

Common Fix

OLLAMA_HOST=127.0.0.1:11434
systemctl restart ollama

# Docker:
docker run -p 127.0.0.1:11434:11434 ollama/ollama

CVE-2025-63389, All Ollama versions. first_patched_version: null.