[Official FAQ] Corrections and follow-up questions welcome.

Yes. Unauthenticated OpenAI-compatible endpoints get scanned, mined for free compute, and may widen attack surface if tools/agents are attached.

Safer patterns:

• Listen on localhost; reach it via SSH, WireGuard/Tailscale, or a zero-trust tunnel.
• Terminate TLS at a reverse proxy with auth, allowlists, and rate limits.
• Never expose shell-capable agent ports publicly.

Inconvenience beats a hijacked GPU. Share architectures without dumping secrets.