本地大語言模型能否阻止程式碼資料外洩？Ollama 的保護範圍與風險

Originally published on ReclaimLLM: https://reclaimllm.com/blogs/local-llms-coding-data-leakage

Local inference cuts third-party API risk when binding and cloud settings are right—but coding agents still read secrets, run curl, and expose misconfigured servers.

Executive summary

• Local inference removes one leak path (third-party model API) but not agent risks (file reads, shell egress, MCP)—and can add exposed servers and cloud-model fallbacks.
• Ollama binds 127.0.0.1:11434 by default; OLLAMA_HOST=0.0.0.0 exposes it, and Ollama has no built-in API auth.
• Cost shifts, it doesn’t vanish: local models trade API token bills for GPUs, power, and ops—benchmark quality and token volume on real workloads before you switch.
• ReclaimLLM’s gateway includes a Local (LiteLLM) provider with a configurable base_url (OpenAI-compatible, including self-hosted Ollama)—not a branded Ollama integration.
• Censys and Cisco published separate exposure studies (Sep 2025); attribute each figure to its own source—don’t average them.

Running a model locally keeps prompts off a third-party inference API only when inference actually stays on your machine, the server is not exposed to the network, and you have not enabled cloud-backed models. A local weights file does not stop a coding agent from reading .env, running curl, or calling MCP servers. For many teams, “just run Ollama” fixes one leak path and ignores the rest.

This article explains what local inference protects, where Ollama and similar servers go wrong in production, and how that compares to centralizing models through an enterprise gateway—including ReclaimLLM’s Local (LiteLLM) provider, which points at any OpenAI-compatible base_url, not a branded Ollama integration.

What local inference does protect

When prompts and completions never leave your network boundary to a public model API, you reduce:

• Provider retention and training risk for that inference path.
• Cross-border transfer to US hyperscaler inference regions (subject to your architecture actually staying local).

That matters for Canadian and EU teams evaluating US cloud providers. It is not a substitute for classifying what developers paste into prompts, securing agent tool access, or logging who used which model on which repo.

Three ways “local” is not local

Network binding

Ollama’s FAQ states it binds 127.0.0.1 port 11434 by default. Changing OLLAMA_HOST—for example to 0.0.0.0:11434 so teammates on a LAN can connect—exposes the API unless you add firewall rules and authentication yourself. Ollama does not ship a built-in auth layer for the HTTP API; exposed instances rely on reverse proxies, VPNs, or network ACLs.

Before you promote “local LLM” in a security review, grep your runbooks for OLLAMA_HOST and confirm bind addresses on every host.

Exposed servers in the wild

Internet-wide scans find many misconfigured inference endpoints. Use each source’s own methodology and date—do not merge unrelated totals.

Different scan methods produce different counts. Treat them as order-of-magnitude warnings, not as your exact external risk score.

If you operate a shared Ollama host, run periodic port scans from outside your VPC the same way you would for any admin API. A model weights tarball on disk does not help if the HTTP API is reachable from the internet without auth.

Cloud models inside Ollama

Ollama can route some workloads to cloud models. Ollama’s documentation states that for those features it processes prompts and responses to provide the service, does not store or log that content for training, and does not train on it—but prompts do leave the machine for that path.

Disable cloud features when you need strictly local inference:

• Set "disable_ollama_cloud": true in ~/.ollama/server.json, or
• Export OLLAMA_NO_CLOUD=1

Disabling cloud models also removes Ollama’s web search feature tied to that stack—plan alternative search policy for agents that relied on it. Verify wording in the current Ollama FAQ before audit season.

Agent risks do not change with a local model

A coding agent—Cursor, Claude Code, Codex, Copilot, or a custom CLI—still:

• Reads files anywhere its tools allow.
• Runs shell commands that print secrets or pipe data outbound.
• Calls MCP servers with their own credentials and network access.

Local weights do not rewrite those tool policies. For the four leak paths and four control layers, see What is AI DLP?. For network exfiltration specifically, see Stopping AI agent network exfiltration.

Local model + agent with no hooks repeats the same read/print/send triangle—only the “send to OpenAI/Anthropic/Google inference” leg might be gone.

OWASP’s Top 10 for LLM Applications still applies: sensitive disclosure and excessive agency are agent problems, not cloud-only problems.

Team options: local laptops vs shared servers vs gateway

ReclaimLLM gateway and local endpoints

ReclaimLLM’s enterprise LLM gateway supports named cloud providers and a built-in local provider shown in admin as Local (LiteLLM). Org admins add it like other providers but set a required base_url (API key can be a placeholder when the endpoint does not need one). That shape fits any OpenAI-compatible server—including an internal Ollama instance serving /v1—without a dedicated Ollama SKU or auto-discovery.

Important distinctions:

• Pointing base_url at http://127.0.0.1:11434 on one developer laptop centralizes policy in the gateway UI but does not make that laptop’s Ollama team-wide infrastructure.
• Prompts stay in-house only if the endpoint is actually internal to your network (VPC, on-prem, or zero-trust mesh)—not an accidentally public 0.0.0.0 bind.

The local ReclaimLLM proxy on localhost:9800 is a separate component (capture and hooks on the machine). Do not conflate it with gateway routing.

Cost: local is not free

Security reviews often stop at “no third-party API bill.” Finance still cares about where the money went. Self-hosted coding models move spend from metered tokens to GPUs (or cloud GPU hours), electricity, model ops, and slower iteration when quality drops and developers retry. That can be the right trade for residency or egress policy—just don’t treat it as a pure savings story without measuring:

• Quality vs your cloud baseline on the same repos and task types (not a leaderboard score alone).
• Token and wall-clock volume of agent sessions—local weights don’t shrink context windows or tool loops by themselves.
• Total cost of ownership (hardware amortization + downtime + who patches the inference stack) against the API spend you actually cut.

For model selection before you switch workloads, ReclaimLLM’s RCLM bench for local coding models and compare models on real workloads help evaluation—they are not security guarantees, and they are not a promise that local will cost less.

Layer controls regardless of model location

Security questionnaires sometimes ask “Is customer code sent to external LLM providers?” Local Ollama lets you answer “not for inference” only after you verify cloud models are off, agents are not dual-homed to a cloud IDE, and no developer still pastes into ChatGPT for “second opinions.” Document that boundary in your AI acceptable-use standard.

Whether inference is local or cloud, ship:

• Pre-tool hooks with env DLP and an egress guard on shell and fetch patterns.
• Coverage monitoring so missing hooks are visible.
• Session capture to prove what was read during an incident.

ReclaimLLM data residency for hosted product data is US and EU. SOC 2 Type II is targeted for early 2027—not yet certified.

Checklist: local models plus coding agents

Considering provider-side leakage paths too? Pair this with source code leakage in AI assistants when published.

Next step: See what your agents read and send—start free.

FAQ

Is Ollama secure by default?

It binds to 127.0.0.1:11434 by default, which is appropriate for single-user local use. Security reviews should still verify OLLAMA_HOST, cloud model settings, and whether any agent can reach a shared bind address without authentication.

Do local LLMs prevent data leakage?

They remove third-party model API disclosure for local inference paths. They do not stop agents from reading secrets, printing them in shell output, or exfiltrating via HTTP unless you add the same hook, sandbox, and monitoring controls you would use with cloud models.

How do I stop Ollama sending prompts to the cloud?

Set "disable_ollama_cloud": true in ~/.ollama/server.json or export OLLAMA_NO_CLOUD=1. Confirm in the current Ollama documentation—cloud features change over time.

Can ReclaimLLM's gateway route to local models?

Yes. Add the Local (LiteLLM) provider with your endpoint’s base_url (OpenAI-compatible). That includes a self-hosted Ollama /v1 server on your network. There is no separate Ollama-branded integration. Prompts stay in-house only if that endpoint is actually internal—not an internet-exposed bind.

Should we skip DLP if the model is local?

No. Local inference does not reduce agent file-read or shell egress risk. Treat local and cloud agents the same for hook coverage and audit evidence.

Originally published at https://reclaimllm.com/blogs/local-llms-coding-data-leakage