research: OllamaDrama/Ollure (arXiv 2609.29757) — empirical attack classes against emulated Ollama management APIs, LLM-deception surface

[Xore]

STATUS 2026-09-28 — Implementation PRs are OPEN and awaiting Niklas' merge. No agent merge authority.

Merge authorization: agents open PRs, Niklas merges

Decision (Niklas, 2026-09-28): NO agent merge authority. Open the PR and report; Niklas merges and closes the issue.

This supersedes the 2026-08-23 standing authorization (gh pr merge --squash --delete-branch once green).
Never merge, never delete a branch, and never close this issue while its implementation merely sits in an open PR.

See the issue comments for per-PR state (branch, commit, test counts).

---

ORIGINAL ISSUE BODY

STATUS 2026-09-28 — §5 ANSWERED: public :8888 HAS been probed with /v1/models

4 hits, 2 distinct source IPs, all 2026-09. Read-only agg, no reindex, no writes, no live traffic. Full numbers and method caveats in the analysis below; raw evidence in the issue comment.

---

§5 ANSWERED — empirical result (2026-09-28)

The read-only aggregation Niklas authorised has been run. Yes — public :8888 has been probed with /v1/models.

query: event.sensor:api-honeypot  AND  url.path:"/v1/models"
total hits: 4   (all 2026-09)

  2026-09-12T02:44:50Z  71.6.237.176  /v1/models
  2026-09-11T18:23:10Z  71.6.237.176  /v1/models
  2026-09-11T19:03:58Z  71.6.243.202  /v1/models
  2026-09-11T16:40:53Z  71.6.243.202  /v1/models

Two distinct source IPs, both hitting the OpenAI-compatible model-list path. This is exactly the class of behaviour the Ollure paper reports, and it is small — two IPs, four requests — which is the honest scale of the signal.

Adjacent surface, same sensor (context for the classifier)

  /v1/models             4     <- the question, answered
  /api/tags              1     <- ollama native list
  /v1/chat/completions   0
  /api/chat              0
  /api/v1/models         0

/api/tags being hit once while /api/chat never is notable: scanners are enumerating, not conversing. The Ollama-native list endpoint is being probed almost as rarely as the OpenAI-compatible one.

Method / caveats

• Read-only _search with size:0 + a date_histogram. No reindex, no writes, no traffic sent at any endpoint.
• The field is url.path, not event.request.path. An initial probe against the wrong field returned 0 and would have produced a false "never probed" conclusion. event.sensor is correct — it matches 11,957 api-honeypot events.
• Index set spans 1034 shards; the agg completed on all of them.
• Whether those 4 requests were answered as the decoy intends (200 with a fake model list vs 401) is not established by this agg — the _source returned no persona/site field for these hits. Follow-up from the event detail, not from this query.

Decision on record (Niklas, 2026-09-28)

Run the read-only aggregation. Scope limited to the read-only agg; no reindex, no writes, no live traffic. The galah prompt-injection follow-on is filed separately as #3448.

[Xore]

Decision (Niklas)

Run the read-only aggregation. Answer §5 of the research doc.

One terms agg on event.sensor: api-honeypot to determine whether public :8888 has actually been probed with /v1/models. Read-only — no reindex, no writes, no traffic sent at any live endpoint. The agent was right that this is the only part of the research question not answerable offline.

Scope of the answer stays as measured: the classifier coverage (34/34 paper shapes, 167 tests) is complete and this only closes the empirical half.

---

_{Logged by the orchestration agent on behalf of Niklas. Authoritative decision: run the agg; do not file a galah prompt-injection follow-on from this PR; the sanitisation bug is a separate issue.}

[Xore]

§5 ANSWERED — empirical result (2026-09-28)

The read-only aggregation Niklas authorised has been run. Yes — public :8888 has been probed with /v1/models.

query: event.sensor:api-honeypot  AND  url.path:"/v1/models"
total hits: 4   (all 2026-09)

  2026-09-12T02:44:50Z  71.6.237.176  /v1/models
  2026-09-11T18:23:10Z  71.6.237.176  /v1/models
  2026-09-11T19:03:58Z  71.6.243.202  /v1/models
  2026-09-11T16:40:53Z  71.6.243.202  /v1/models

Two distinct source IPs, both hitting the OpenAI-compatible model-list path. This is exactly the class of behaviour the Ollure paper reports, and it is small — two IPs, four requests — which is the honest scale of the signal.

Adjacent surface, same sensor (context for the classifier)

  /v1/models             4     <- the question, answered
  /api/tags              1     <- ollama native list
  /v1/chat/completions   0
  /api/chat              0
  /api/v1/models         0

/api/tags being hit once while /api/chat never is notable: scanners are enumerating, not conversing. The Ollama-native list endpoint is being probed almost as rarely as the OpenAI-compatible one.

Method / caveats

• Read-only _search with size:0 + a date_histogram. No reindex, no writes, no traffic sent at any endpoint.
• The field is url.path, not event.request.path. An initial probe against the wrong field returned 0 and would have produced a false "never probed" conclusion. event.sensor is correct — it matches 11,957 api-honeypot events.
• Index set spans 1034 shards; the agg completed on all of them.
• Whether those 4 requests were answered as the decoy intends (200 with a fake model list vs 401) is not established by this agg — the _source returned no persona/site field for these hits. Follow-up from the event detail, not from this query.

Decision on record (Niklas, 2026-09-28)

Run the read-only aggregation. Scope limited to the read-only agg; no reindex, no writes, no live traffic. The galah prompt-injection follow-on is filed separately as #3448.

[Xore]

MERGE AUTHORIZATION (Niklas, 2026-09-28): NO. Open the PR, Niklas merges.

Recorded here so no future round re-asks. This supersedes the earlier standing authorization (2026-08-23) that read gh pr merge --squash --delete-branch once green.

Standing rule: agents open PRs and report; they do not merge, and they do not close an issue whose implementation is merely sitting in an open PR. Issue closure follows the merge, and Niklas performs both.

Still true: Closes #N in a PR body is not proof the issue closed - verify state directly.

Refs #3189, #3364, #3430, #3394, #3212, #1805.

[Xore]

Closing as completed.

Verified on main:

• docs/research/3394-ollure.md and docs/research/3394-ollure-attack-classes.md both present.
• Galah prompt-injection detection shipped in feat(galah-llm-broker): prompt-injection coverage for the galah decoy (#3448) #3466 (galah-llm-broker/injection.go + tests) — that is the detector half of the Ollure §4 gap.
• TestOllure3394CorpusMeasurement in the http-honeypot package passes, pinning the measurement so it can't silently drift.

Note the scope this closes: the research writeup and the detection. The delivery and pipeline halves are tracked separately — see the close comment on #3448.