[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-bleeding-llama-ollama-cve-2026-7482":3,"topics-all":33,"news-related-a8b15389-be6a-4bc6-9163-229cc3d5f3ea":52},{"id":4,"title":5,"summary":6,"content":6,"original_url":7,"source_id":8,"tags":9,"translations":20,"news_slug":26,"published_at":27,"created_at":28,"modified_at":29,"is_published":30,"publish_type":31,"image_url":13,"view_count":32},"a8b15389-be6a-4bc6-9163-229cc3d5f3ea","「Bleeding Llama」漏洞揭露：本地LLM推理的三大安全误区","## 「Bleeding Llama」漏洞揭露：本地LLM推理的三大安全误区\n\n2026年5月5日，安全研究机构 Cyera 披露了一个让开源社区警觉的漏洞：CVE-2026-7482，代号「Bleeding Llama」。该漏洞存在于 Ollama（全球最流行的本地大模型运行平台，GitHub 星标超过 17 万）的 GGUF 模型加载器中，允许攻击者通过构造恶意的 GGUF 文件，对运行中的进程内存发起越界读取。三次未经认证的 API 调用，即可从暴露的约 30 万台 Ollama 服务器中窃取聊天记录、系统提示词、环境变量乃至 API 密钥。\n\n**GGUF 不只是「一坨数字」**\n\n理解这个漏洞的关键，在于重新认识 GGUF 文件的本质。GGUF（Georgi Gerganov Universal Format）诞生于 2023 年 8 月，是 llama.cpp 项目为本地推理场景量身打造的模型容器格式。一个 GGUF 文件由三个部分组成：魔数与版本头、元数据键值对、张量信息表与实际数据。其中，张量信息表声明了每个神经网络层在文件中的偏移量、维度和量化类型，而运行时依赖这些信息将二进制数据映射到内存缓冲区。问题在于：如果文件在元数据中撒谎——声明的维度与实际数据不符——加载器不会验证，就会在 process heap 上越界读取邻近内存。\n\n这并非孤例。2025 年已有研究（OpenReview,「Mind the Gap」）指出 GGUF 量化流程中后门植入的可能性；更早的 LLMQuA 论文也系统论证了在量化阶段注入后门的可行性。Bleeding Llama 让这个风险从「理论可能性」变成了「可大规模利用的真实漏洞」。\n\n**三大认知误区**\n\n这个漏洞撕开了本地推理安全叙事的三层幻觉：\n\n- **「本地 = 安全」的假设不再成立。** 当攻击者能远程从你的 Ollama 实例中抽走 API key 和对话历史，本地模型的「隐私护城河」便不再成立。\n- **量化文件不是静态归档，而是可执行容器。** 将 GGUF 视为无害权重 blob 的用户，实际上在信任一个可能被动手脚的运行时接口。\n- **模型文件供应链安全需要重新审视。** 从 Hugging Face、ModelScope 或任何第三方渠道下载的量化模型，在加载前需要做格式校验——这是此前极少有人在本地推理场景中强调的事情。\n\n**启示：开源推理基础设施的补课时刻**\n\nBleeding Llama 之于 AI 安全，某种程度上相当于 Log4Shell 之于软件供应链：它揭示的不是某行代码的失误，而是整个类别的基础设施层在默认假设上的系统性偏差。Ollama 团队已在 0.17.1 中修复了该漏洞（https:\u002F\u002Fgithub.com\u002Follama\u002Follama\u002Freleases），但 30 万台暴露服务器中仍有大量未更新。对于本地推理生态而言，这场补课的成本不低：用户需要建立模型文件签名校验意识，平台需要强化 GGUF 加载器的边界检查，而开源社区需要重新审视「方便」与「安全」之间长期被低估的折算关系。\n\n本地大模型正在从极客玩具走向企业生产，基础设施的每一层——包括曾被认为「够用了」的模型加载器——都该升级到对应的安全水位。","https:\u002F\u002Fwww.cyera.com\u002Fresearch\u002Fbleeding-llama-critical-unauthenticated-memory-leak-in-ollama","dad69050-8750-4b31-a3eb-4b689b5562eb",[10,14,17],{"id":11,"name":12,"slug":12,"description":13,"color":13},"fca9258a-9430-455a-b95d-b9fae5e373a8","ai-inference",null,{"id":15,"name":16,"slug":16,"description":13,"color":13},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",{"id":18,"name":19,"slug":19,"description":13,"color":13},"01598627-1ea6-4b27-a5d8-874971571a71","llm",[21],{"id":22,"lang":23,"title":24,"summary":25,"content":13},"d68163b9-3f75-4bd2-96e3-477b785a8562","en","Bleeding Llama: three security myths in local LLM serving","On May 5, 2026, security research firm Cyera disclosed a vulnerability that has the open-source community on alert: CVE-2026-7482, codenamed \"Bleeding Llama.\" The vulnerability lives in the GGUF model loader of Ollama (the world's most popular local-LLM runtime platform, with over 170,000 GitHub stars), and allows attackers to launch out-of-bounds reads against the running process's memory by crafting malicious GGUF files. Three unauthenticated API calls are enough to steal chat history, system prompts, environment variables, and even API keys from an exposed Ollama server, of which there are about 300,000.\n\n**GGUF is more than \"a blob of numbers\"**\n\nThe key to understanding this vulnerability is to revisit the essence of GGUF files. GGUF (Georgi Gerganov Universal Format) was born in August 2023, a model container format tailored by the llama.cpp project for local-inference scenarios. A GGUF file consists of three parts: magic number and version header, metadata key-value pairs, and tensor info table with actual data. The tensor info table declares the offset, dimension, and quantization type of each neural network layer in the file, and runtime uses this information to map binary data into memory buffers. The problem: if the file lies in its metadata — declared dimensions don't match actual data — the loader won't validate, and will read out-of-bounds on adjacent process-heap memory.\n\nThis isn't an isolated case. 2025 research (OpenReview, \"Mind the Gap\") already pointed out the possibility of backdoor implantation in GGUF quantization; an earlier LLMQuA paper systematically demonstrated the feasibility of injecting backdoors at the quantization stage. Bleeding Llama turned this risk from \"theoretical possibility\" into \"exploitable real-world vulnerability at scale.\"\n\n**Three cognitive misconceptions**\n\nThis vulnerability tears open three layers of illusion in the local-inference security narrative:\n\n- **The \"local = secure\" assumption no longer holds.** When attackers can remotely extract API keys and conversation history from your Ollama instance, local models' \"privacy moat\" no longer holds.\n- **Quantization files are not static archives but executable containers.** Users who view GGUF as harmless weight blobs are effectively trusting a runtime interface that could be tampered with.\n- **Model-file supply-chain security needs to be revisited.** Quantized models downloaded from Hugging Face, ModelScope, or any third-party channel need format validation before loading — something rarely emphasized in local-inference scenarios.\n\n**Implications: catch-up time for open-source inference infrastructure**\n\nBleeding Llama, for AI security, is in some ways equivalent to Log4Shell for software supply chains: it reveals not a single line of code's mistake, but a systematic default-assumption bias across the entire category of infrastructure. The Ollama team has already fixed the vulnerability in 0.17.1 (https:\u002F\u002Fgithub.com\u002Follama\u002Follama\u002Freleases), but a large number of the 300,000 exposed servers remain unpatched. For the local-inference ecosystem, the cost of this catch-up is non-trivial: users need to build model-file signature-verification awareness, platforms need to strengthen GGUF loaders' boundary checks, and the open-source community needs to re-examine the long-underestimated trade-off between \"convenience\" and \"security.\"\n\nLocal large models are moving from geek toys to enterprise production; every layer of infrastructure — including model loaders once thought \"good enough\" — needs to be upgraded to a matching security bar.","bleeding-llama-ollama-cve-2026-7482","2026-05-18T02:10:00Z","2026-05-18T10:11:32.130849Z","2026-08-19T02:08:40.142862Z",true,"agent",212,[34,43],{"slug":35,"tag_slug":35,"title_zh":36,"title_en":37,"intro_zh":38,"intro_en":39,"id":40,"is_active":30,"created_at":41,"modified_at":42},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":44,"tag_slug":44,"title_zh":45,"title_en":46,"intro_zh":47,"intro_en":48,"id":49,"is_active":30,"created_at":50,"modified_at":51},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":53},[54,59,64,69,74,79],{"id":55,"title":56,"news_slug":57,"published_at":58},"218e966c-1521-44eb-87d1-dba77cc26c9c","CyberGym 的 86.3%：GLM-5.2 安全 Agent 开始用证据说话","cybergym-glm-52-evidence-agent","2026-07-29T06:33:39+00:00",{"id":60,"title":61,"news_slug":62,"published_at":63},"b485d30c-0640-4349-aa6f-69bdd9d3e935","Meta 撤回条款中抓取训练条款,出版商赢得一次窄胜利","meta-withdraws-ai-training-clause-terms","2026-10-21T07:10:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"c2c96e3a-cc8d-4970-8d9d-e9584bbc9237","WhatsApp 帮助页藏 102 块 LLM 暗指令","whatsapp-hidden-llm-instructions-help-pages","2026-10-19T16:00:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"ab1e6bdf-9433-41f0-be4d-cc0f78523ac2","SonicBoom v0.0.3:一个 .so 干掉手工调优","sonicboom-v003-mlir-compiler","2026-10-19T09:03:05+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"cdcd6b11-8a65-4b15-9add-6fa9343de5a3","十分钟 AI 协助后,人为何突然不愿再解题","arxiv-2604-04721-ai-persistence-reduces","2026-10-17T07:00:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"0141e95e-e10e-4d88-bf4a-4d1e7df9bfaa","十分钟用 AI 就让人失去攻克难题的意志力","ten-minutes-ai-erodes-persistence-hard-tasks","2026-10-16T03:00:00+00:00"]