Imagine you leave a mannequin in a parked car with the windows down and a laptop visible on the seat, then install hidden cameras. You're not testing whether the mannequin gets stolen — you're cataloging who walks by, who peers in, who reaches for the laptop, and who brings lock picks. That's exactly what Ollure does: it mimics the Ollama REST API well enough to fool scanners and script kiddies, but there's no actual LLM behind the curtain. Every probe, every payload, every prompt injection gets logged. The committed claim: this is the first purpose-built honeypot for self-hosted LLM infrastructure, and it produces the first empirical taxonomy of real-world attacks against exposed Ollama endpoints. Over 84 days across four deployments (two cloud, two university), Ollure recorded 290,887 interactions from 2,793 unique source IPs. The bulk — as you'd expect — was automated discovery: bots probing /api/tags and /api/version to fingerprint the service and enumerate available models. But the interesting part is the long tail. That tail includes concrete exploitation at both the infrastructure and LLM layers. On the infrastructure side, attackers sent path traversal probes, SSRF payloads, RCE attempts, and cryptocurrency mining scripts. On the LLM layer, the researchers captured prompt injection, information extraction attempts, and — notably — agent-oriented tool-use requests, where attackers tried to invoke tool-calling capabilities to break out of the language model sandbox. This is the kind of attack that barely existed two years ago and is now showing up in automated scans. Architecturally, Ollure operates as a low- and medium-interaction honeypot — a well-established family in the security research toolkit (think Cowrie for SSH, or Dionaea for malware). The low-interaction mode returns canned API responses to fingerprinting queries. The medium-interaction mode goes further, simulating model management endpoints (/api/pull, /api/create, /api/delete) to lure attackers into revealing their full exploit chains. There's no GPU, no model weights, no inference — just a Flask-style API facade with logging. The design trades realism for safety and deployability. Integrity is honest but bounded. The researchers deployed across four sites for geographic and network diversity, which is good practice. They acknowledge the core limitation clearly: a honeypot without a real LLM backend cannot capture the full range of prompt-based attacks, because sophisticated adversaries will bail when the responses don't make sense. The 84-day window is decent but not long by honeypot standards. There's no pre-registration, no community benchmark to compare against (none exists for this threat class), and no independent replication. The data appears to be well-logged but the paper is descriptive rather than hypothesis-testing — this is empirical observation, not controlled experiment. The milestone that matters is straightforward: the next version needs a real LLM backend — even a small, sandboxed one — to capture the full prompt injection and jailbreak attack surface. The authors essentially say this themselves. Right now Ollure captures the infrastructure-layer attacks comprehensively but only scratches the surface of LLM-layer exploitation because attackers who get nonsensical responses stop engaging. A high-interaction honeypot with, say, a quantized 7B model behind the API would dramatically expand the observable attack surface. That's the gap. The successor experiment the authors didn't run is longitudinal deployment at scale — dozens of nodes across multiple cloud providers and geographies, over 6-12 months, with a real (sandboxed) model backend. The honest read is (a): they ran out of compute and infrastructure budget. A four-node, 84-day study is already a meaningful logistics effort for a university research group. The next step requires either institutional backing or a partnership with a cloud provider willing to donate capacity. The tooling is open-source, so the community can extend it — but the next meaningful result requires resources this team likely didn't have. What makes this paper useful isn't methodological novelty — honeypots are a mature technique. It's that someone finally pointed a honeypot at the LLM attack surface and produced real numbers. Before this, discussions of LLM infrastructure threats were largely theoretical. Now we have 290K data points showing what actually happens. That's the contribution: not a new method, but a new empirical baseline for a threat class that's growing faster than the security community's ability to study it.
