GPT4Free Investigation Finds Prompts May Pass Through Unclear Providers and Be Logged
Summary
Gen Threat Labs found that GPT4Free may route prompts through multiple providers and external AI servers, log prompts alongside IP and location data, and return a different model than the one selected. Researchers could not verify live logs or endpoint owners’ consent.
Key points
- Testing found cases where GPT4Free responses identified a different model than the one selected; researchers could not determine where the change occurred.
- GPT4Free provider data listed more than 200 Ollama endpoints in a seed file and additional custom providers, including personal-looking domains and infrastructure linked to other organizations.
- Researchers could not establish why listed servers were available or whether their owners knowingly provided capacity; some tested endpoints were reachable while others were offline.
- Code analysis found usage and error logging paths with stated retention periods of 14 and 30 days; usage fields include IP address, approximate location, provider, model, and conversation data.
- With conversation history enabled, the opening prompt may be repeatedly eligible for logging; disabling history sends each new prompt as a standalone message that may also be logged.
- Researchers could not locate the hosted service’s Privacy Policy or Terms of Service through the provided links or their searches.
- The researchers advise against entering sensitive information into unofficial AI services and warn Ollama operators that exposing the API can undermine local privacy.
Article Details
- Attack Vectors
- GPT4Free routes prompts through multiple providers and external model endpoints, potentially including publicly reachable Ollama or llama.cpp servers whose ownership and relationship to the service are unclear.
- The Toolbaz integration recreates expected browser requests, generates a browser fingerprint, and creates a fresh identity for each request, making automated requests resemble separate human visits.
- GPT4Free's usage-logging code can record requester IP addresses, approximate geolocation, provider, model, and conversation data. The researchers did not access live stored logs.
- Defensive Notes
- Treat prompts submitted to unofficial AI services as potentially visible to multiple providers; do not include passwords, authentication tokens, confidential documents, internal information, or sensitive personal data.
- Ollama operators should ensure that the API is not exposed to the public internet unless intended.
- Before using an AI service, assess where prompts are sent, who processes them, and what data is retained; do not assume that disabling conversation history prevents individual prompts from being logged.
Vendors
Anthropichosted version, where visitors can choose from models carrying names associated with OpenAI, Google, Anthropic and other developers without creating separate accounts with those companies. Googleon that hosted version, where visitors can choose from models carrying names associated with OpenAI, Google, Anthropic and other developers without creating separate accounts with those companies. OpenAIconcentrated on that hosted version, where visitors can choose from models carrying names associated with OpenAI, Google, Anthropic and other developers without creating separate accounts with those companies.
Products
GeminiSeveral of our tests used options associated with the Gemini provider. The prompts travelled through an OpenAI-compatible chat endpoint on g4f.space before being directed to Google’s Gemini infrastructure, but in someGPT-5.2The response also introduced another unresolved model name. We requested gpt-5.2, but the returned metadata identified toolbaz-v4.5-fast. Toolbaz describes ToolBaz-v4.5-Fast as its proprietary model and presents itGPT4Freeto follow the prompt. What looked like a simple conversation quickly became much more crowded, with GPT4Free infrastructure, provider code, third-party services and external model endpoints all potentially playingllama.cppin the material we examined. When we tested a selection, some responded as working Ollama or llama.cpp services and others had already disappeared. Ollamawhere some of those requests might be processed. The project includes lists of externally accessible Ollama systems, including servers on personal-looking domains and infrastructure associated with organizationsToolBaz-v4.5-Fastanother unresolved model name. We requested gpt-5.2, but the returned metadata identified toolbaz-v4.5-fast. Toolbaz describes ToolBaz-v4.5-Fast as its proprietary model and presents it separately from