---
title: "A private LLM is an audit result, not a download: what still left the machine after we brought the model home"
slug: local-private-llm-egress-audit
date: 2026-08-06
excerpt: "Moving an open-weight model on premise does not make the workflow private by itself. An egress audit of our own local-first harness found six kinds of outbound connection, and the most surprising one was two fonts."
featured_image: "https://bbtxujdxvidaghmhxkqs.supabase.co/storage/v1/object/public/generated-images/blog-1786003006667-local-private-llm-egress-audit.webp"
featured_image_alt: A workstation tower on a dark desk with several thin amber light traces leaving it through a wall, each passing through a small glowing checkpoint ring, while one teal trace loops back into the machine, illustrating an egress audit of a locally hosted AI system.
canonical_url: https://cerevisor.com/blog/local-private-llm-egress-audit
updated_at: 2026-08-13T12:00:41.141533+00:00
---

# A private LLM is an audit result, not a download: what still left the machine after we brought the model home

By the founder of Cerevisor

TLDR

Running an open-weight model on hardware someone owns does not make the workflow private by itself. The app around the model, the port it listens on, and the agent tools wired to it each have their own ways of sending data out. I ran an egress audit on our own local-first harness this week and found six kinds of outbound connection, none of them carrying prompts, two of them surprising me anyway. The honest claim is never "nothing leaves the machine". It is "here is the list of what leaves, and who can turn each item off".

On August 2 the European Commission’s AI Office picked up its enforcement powers for general-purpose AI: the authority to demand documentation, evaluate models directly, and fine providers. An analysis from Beam published August 4 made the point that matters for anyone self-hosting: “If you deploy AI agents that touch EU users, this is not a vendor’s problem you can watch from a distance. Your model vendor’s compliance posture is now part of yours.”

That same week I did something I recommend to every team that has ever said “we run a private LLM”: I read our own product’s network behavior line by line and wrote down everything that leaves the machine.

The myth I wanted to test is the one this whole category runs on. A private LLM, meaning a [language model](/blog/small-language-model-laptop-no-gpu) that runs on infrastructure the team controls instead of a vendor’s cloud, is usually treated as private by construction. The weights sit on the GPU in the office, therefore the work is confidential, therefore compliance is handled. That chain of “therefores” is where the trouble lives.

## Why “the weights are on our GPU” feels like the whole answer

The reasoning is partly true, which is what gives it legs. Inference, the actual work of generating text from the model, really does happen locally in a self-hosted setup: prompts and documents travel to a model server on the same machine or rack, and no API vendor ever sees them. That is a real guarantee, and it is why regulated teams look at open-[weight models](/blog/local-open-weight-models-june-signals) at all.

The mistake is promoting a statement about one network path into a statement about the whole system. The model call is one socket. A working AI setup has many.

---

## Where local AI setups actually leak: apps, ports, and cloud tiers

The public record this year is a catalog of the gap between “the model is local” and “the data stays local”.

The app layer first. A security checklist published by PromptQuorum on June 19 notes that several popular desktop LLM apps collect anonymous usage analytics by default, including session counts and the names of models used. Not prompts, but a running record of activity, on by default, in tools people installed specifically to avoid sending things out. A June writeup from SolidAITech flagged a different version of the same drift: Ollama, the local runner most guides recommend first, now offers paid cloud tiers alongside its free local mode, with cloud-connected features routing prompts through the vendor’s servers. Same brand, same window on the screen, different place the text goes.

Then the network layer. In May, Qualys wrote up CVE-2026-7482, a memory-leak vulnerability in Ollama’s model-creation endpoint: an unauthenticated request with a malformed model file could make the server hand back fragments of memory, including keys and text from other users’ conversations. It was patched quickly, in version 0.17.1. The number that stays with me is not the severity score.

~300,000

internet-reachable Ollama servers cited in May 2026 coverage of CVE-2026-7482, on software many operators installed to keep data private

Those servers were not exposed by the model. They were exposed by a configuration choice: the inference server, the program that listens for requests and runs the model, hears only its own machine by default, and one setting opens it to the whole network. Thousands of teams flipped that setting to share a GPU across the office and never put authentication in front of the port. Every one of them would have described their deployment as a private LLM.

Key Insight

Every documented local-AI privacy failure this year happened somewhere other than the model: a default analytics flag, a cloud tier inside a local app, an open port. The weights were exactly where their owners thought they were the whole time.

## The egress audit on our own harness, including the embarrassing part

Cerevisor is a local-first [control plane](/blog/harness-who-owns-coding-agent-control-plane-org-chart) for AI agents, so this myth is our own marketing risk, and the only credible way to talk about it is to audit ourselves in public. Egress here means any connection the software opens to a machine outside the building, whatever it carries. The full inventory, for a setup using a local model:

Every outbound connection, one desktop harness, local model configured

ConnectionWhat rides on itWhen

Model callsPrompts and outputs, to the configured endpoint only. Local setup: a loopback address, so nothing leavesEvery run
License checkThe license key and an install identifier, to the payment provider. No prompts, no workspace dataActivation and periodic revalidation
Update checkApp version and, implicitly, the machine's address, to our release serverPackaged builds, on launch
Web search toolThe agent's search query, to whichever search provider the user connectedOnly when an agent calls the tool
Browser toolWhatever page an agent navigates toOnly when an agent uses it
Interface assetsTwo fonts from a public CDN at startup; the code viewer's editor engine from another CDN on first openStartup and first file view

Two rows earned their place in this piece. The first is the agent tools, the largest real egress surface. A search tool exists to send the agent’s question to the internet. That is the job. If the question was built from a confidential document, a summary of confidential material just left the building through a feature working exactly as designed, which is why we treat tool access as a per-agent decision rather than a global switch.

The second is the last row. Our interface pulls two fonts from a public content-delivery network when it starts, and the built-in code viewer fetches its editor engine from another one the first time it opens. No prompt has ever touched either connection, but an egress audit does not grade on intent: everywhere outside an air-gapped network, those fetches tell two CDN operators that a machine at this address just started our app. The fix is boring, bundle the assets into the installer, and it went on our list the day the audit surfaced it.

What the audit did not find is easy to state because there is nothing to describe. There is no usage analytics endpoint. The only thing in our codebase named telemetry is a log written to local disk, capped in size, and wipeable from the interface. And the memory subsystem, where the harness stores what it learns about how someone works, ships with zero outbound network paths, with every consent flag for any future sharing feature defaulting to off. The full inventory of what is stored and who consented to what is documented on the [data inventory and consent](https://cerevisor.com/docs/guides/memory-and-learning/data-inventory-and-consent) page.

---

## Privacy lives in the socket list, not in the model’s street address

So the reframe: a private LLM is not a thing that can be downloaded. It is a property of a whole deployment, verified at the level of network connections, not model files. The claim worth making to a board or an enterprise customer is a short table like the one above: every outbound connection, what rides on it, which of them the operator can turn off. A team that can produce that table has a privacy posture. A team that can only point at where the weights live has a hope.

> The weights being local is one row of the table. The table is the privacy story.

The August 2 enforcement date sharpens this from good hygiene into paperwork that earns its keep. As of this month the fine ceiling for general-purpose AI providers is real, and per Beam’s August 4 analysis:

> "up to 3% of global annual turnover or €15 million, whichever is higher"

Beam AI, August 2026

The heaviest duties land on the labs that train the models, not on teams deploying them, so nobody self-hosting a model should read that number and panic. But the same analysis is right that a deployer now inherits part of the vendor’s compliance posture, and an egress inventory is the first page of that file: the document that shows where data can and cannot go, written before anyone official asks.

## An afternoon audit before the next compliance question

The whole exercise fits in an afternoon. Watch the machine’s outbound connections for one idle hour and one working hour, and write down every destination. Read the network permissions of every AI app in the stack, the way I did with ours. Check the inference server’s listening address and what stands between its port and the rest of the network, remembering the 300,000. Then list which agent tools can send data out by design, and decide per agent whether they should.

Most teams that run this find the same shape I did: the prompts are as local as promised, and the edges are fuzzier than anyone had written down. That is not a scandal. It is the difference between a slogan and an audit, and the audit is the version that holds up in the meeting.

#### Sources

- [EU AI Act 2026: GPAI Enforcement & 3% Fines Begin](https://beam.ai/agentic-insights/eu-ai-act-enforcement-august-2-2026-gpai-fines) - Beam AI, 2026-08-04

- [Ollama Heap Out-of-bounds Read Vulnerability Leads to Remote Process Memory Leak (CVE-2026-7482)](https://threatprotect.qualys.com/2026/05/11/ollama-heap-out-of-bounds-read-vulnerability-leads-to-remote-process-memory-leak-cve-2026-7482/) - Qualys ThreatPROTECT, 2026-05-11

- [Local LLM Security 2026: 12-Point Checklist](https://www.promptquorum.com/local-llms/local-llm-security-privacy-checklist) - PromptQuorum, 2026-06-19

- [Local LLMs 2026: The Hidden Cloud Tiers Privacy Catch](https://www.solidaitech.com/2026/07/local-llm-privacy-ollama-cloud-tiers.html) - SolidAITech, 2026-06-30