A fine-tuned model that behaves on a laptop behaves differently the moment it has a public IP. The code has not changed, but the threat model has, and nothing in the deployment announces it. Somewhere between the notebook that worked and the demo link sent to a colleague, a weekend project turns into an internet-facing inference service with an open API, a GPU attached to a billing account, and nothing authenticating either one.
The usual complaint about shared hosting is that it is too slow for machine learning work, though the binding constraint is permission. A typical shared plan runs your code inside a restricted user account: no root, no service manager, no arbitrary listening ports, and process limits that terminate anything still running once the request cycle ends. A persistent model server is ruled out before performance enters the conversation, and so are the controls you would use to secure one. Teams evaluating servers for AI projects tend to discover this in the wrong order; they benchmark inference latency, get a number they can live with, then find the platform will not keep a process alive between requests.
A virtual private server changes the question from what the platform permits to what you configure. Dedicated CPU, memory and storage matter for throughput, but root matters more for control, since the firewall rules, the reverse proxy, the service units, the log retention and the patch cadence all become yours. A VPS for developers running inference, vector search or a scheduled fine-tuning job is attractive mostly because those five things stop being someone else's decision.
They also stop being someone else's responsibility. A shared plan that will not let you open port 11434 is, in one narrow sense, safer than a box where you can and did; the restriction was doing unglamorous security work on your behalf.
The host rarely stays a single inference process. A team can wire in an AI visibility MCP, a database connector and a filesystem tool inside one afternoon, and every one of those Model Context Protocol servers reads secrets from the environment and makes outbound calls on an agent's behalf. Retrieval pipelines, schedulers, vector stores, dashboards and workflow runners arrive over the following weeks on the same pattern, each with its own listener and its own credentials sitting on disk.
Consider what a compromised host actually yields at that stage. Not the model, which is usually a public download anyway, but a credential set: provider API keys, database strings, cloud tokens, and whatever the agent was permitted to reach. A VPS for developers who add tooling weekly needs a review cadence attached to it, since the attack surface on day sixty bears little resemblance to the one that was hardened on day one. Most self-hosted AI incidents come down to a default bind address, a firewall rule opened for a quick test, and nobody revisiting either before the project stops being a test.
Cisco Talos researchers built a Shodan-based detection tool and, in a study published in September 2025, found 1,139 Ollama servers reachable without authentication. More than a thousand of them surfaced within the first ten minutes of scanning. Roughly 19 per cent were actively serving models; the remainder had nothing loaded but stayed open to unauthorised model uploads and configuration changes, which is a distinction with limited comfort in it.
The uniformity is the part worth sitting with. Close to 89 per cent of those endpoints answered on OpenAI-compatible routes, so a single script written against one API works across most of the population. That is the economics of the problem: reconnaissance is cheap, exploitation is templated, and the marginal cost of trying your host rounds to zero. Prompt injection and poisoning earn the coverage they get, while the entry point in these cases is older and duller, an open port indexed by a search engine anyone can query for the price of a subscription.
The frameworks compound it, usually by design. CVE-2023-48022 describes arbitrary code execution through the job submission API in Anyscale Ray, and the NVD entry scores it 9.8 on CVSS. The record is tagged as disputed, and the vendor position recorded on the same page is that the report is irrelevant because Ray is not intended for use outside a strictly controlled network environment.
Both things hold at once, which is what makes the case worth reading closely. The framework behaves as documented, and the documentation assumes a network boundary that a single developer provisioning a cluster on a rented box has not built. CISA's coordinator assessment on that record classifies the issue as automatable with total technical impact. Token authentication became available as an option from version 2.52.0, though an optional control in a framework most people deploy from a copied configuration file is a control that frequently stays off. The gap is rarely a misunderstanding of the software; it is the distance between the network the maintainers assumed and the one a solo builder actually has.
Growth is the point at which the rest of this unravels. Adding a second node, a queue and a shared object store turns one host into a small distributed system, and distributed systems carry internal traffic that developers treat as private on the grounds that it is internal. The catch is that scalable compute resources are easy to buy and hard to segment. The snapshot restores, the vertical resize completes, and the firewall rules that applied to the original instance simply do not exist on the new one.
Cost and security stop being separate concerns at that point. An exposed inference endpoint is free compute for whoever finds it, and the bill arrives looking like ordinary usage. Teams already auditing wasted inference cycles across their own workloads rarely budget for the possibility that a share of their GPU hours belongs to somebody else's traffic. Resource hijacking usually registers as a capacity problem weeks before anyone reads it as an intrusion, and scalable compute resources stretch that lag further, because the obvious response to slow throughput is to provision more of it.
The direction of travel is towards authentication that ships switched on rather than documented as available, and the frameworks are getting there unevenly. Optional token auth in a distributed compute framework is progress; an inference server that still binds wide open by default is not. Until the defaults invert, the operator holds the boundary, whether or not anybody on the team has agreed to hold it.
Which reframes the procurement question. Choosing servers for AI projects is no longer a matter of how much compute arrives for the money. It is a matter of how much perimeter comes attached to it, and whether the person who provisioned the box on a Thursday afternoon will still be watching it in March.