Local AI Security Fragility: Vulnerabilities Inside the Engine Running Your Local Models

Cyera Research reports discovery of ten vulnerabilities in the widely used llama.cpp local AI inference project — including two high-severity (9.2) Use-After-Free bugs — with proof-of-concept exploits that can cause crashes, leak sensitive data, or enable arbitrary code execution on servers and mobile apps. The issues affect many downstream tools (Ollama, LM Studio, GPT4All, etc.), several findings remained unpatched at time of reporting, and the research covers technical details, responsible disclosure, patches, and business implications for organizations running local AI.