Week 45, updated 2 Nov 2026

Local AI llama.cpp

Is llama.cpp safe?

Short answer: Caution. StackGrade's weekly scan of ggml-org/llama.cpp gives it a Caution label for 12 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 107 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove llama.cpp is exploitable in your setup. Automated scan of commit 785322d on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Fast LLM inference in C/C++, the engine behind many local AI apps.

  • 133,105 stars
  • pushed 2 Nov
  • MIT
  • C++

github.com/ggml-org/llama.cpp · llama.app

68score out of 100

#9of 52 overall#4in Local AI▲ 4 vs Week 44

  • Maintenance 30%83
  • Adoption 30%78
  • Docs 20%29
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 67, 63, 64, 68.

Caution

12 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 2 Nov 2026. Last 10 GitHub releases within 1 day (about 270 per 30 days), latest release 1 Nov 2026. Issue close time: fewer than 5 closed issues, so not used.
  • Adoption: 133,105 stars (70%), 25,043 forks (30%).
  • Docs: README 7,670 characters, 11 headings, 2 code blocks, install section: yes.

Methodology

#4 of 5 in Local AI

Ranked by score. The yellow row is this tool.

Local AI, Week 45score 0–100, safety
  1. 1Ollama#2 overall73Caution
  2. 2LobeHub#7 overall69Caution
  3. 3Open WebUI#8 overall68Caution
  4. 4llama.cpp#9 overall68Caution
  5. 5vLLM#24 overall54Caution

Safety scan, 2 Nov 2026

Automated scan of commit 785322d, 1,043 files. Not a manual audit.

Caution

  • 12Critical dependency advisories107 high, 58 medium, 11 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 8Agent files checked0 phrases flagged for review.
  • 3curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 12 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 12 critical, 107 high, 58 medium, 11 low, 2 unrated

  • aiohttp@3.9.5 (PYSEC-2026-2102) in requirements.txt
  • transformers@4.57.6 (PYSEC-2026-2290) in requirements.txt
  • anyio@4.9.0 (PYSEC-2026-4025) in requirements.txt
  • certifi@2026.7.22 (PYSEC-2026-4320) in requirements.txt
  • pillow@9.5.0 (PYSEC-2026-4330) in requirements.txt

Also found (informational, does not change the label):

  • 107 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Documents curl|sh style installer (3 occurrences, e.g. .devops/s390x.Dockerfile)
  • Critical advisories counted once per package: 57 matches across 13 lockfiles

Notes:

  • 21 affected packages only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: amplitude

Automated scan of commit 785322d on 2 Nov 2026, not a manual audit. 1,043 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest b12033, 1 Nov
  • –Median issue closeFewer than 5 closed issues
  • 133kStars+728 since 26 Oct
  • 25kForks2,599 open issues
  • 2023Repo created10 Mar 2023
30 days ago2 Nov
10 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

10 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about llama.cpp

Answers use this week's StackGrade data.

Is llama.cpp safe to use?

Caution. StackGrade's weekly scan of ggml-org/llama.cpp gives it a Caution label for 12 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 107 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove llama.cpp is exploitable in your setup. Automated scan of commit 785322d on 2 Nov 2026, not a manual audit.

How does StackGrade score llama.cpp?

llama.cpp scores 68 out of 100 in Week 45: #9 of 52 tracked tools overall and #4 in Local AI. The score combines maintenance (83), adoption (78) and docs (29) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to llama.cpp?

The highest-scored other tools in Local AI this week: Ollama (73, Caution), LobeHub (69, Caution), Open WebUI (68, Caution), vLLM (54, Caution). StackGrade has not tested them hands-on.

What licence does llama.cpp use?

The licence listed for ggml-org/llama.cpp is MIT. Read the licence text before commercial use.

Compare and use it

Used in 1 AI use case

All facts and sources
Type
AI tool
License
MIT
Language
C++
Created
10 Mar 2023
Owner
ggml-org (Organization)
Forks
25,043
Homepage
llama.app

GitHub description: “LLM inference in C/C++”

Sources: github.com/ggml-org/llama.cpp, api.github.com/repos/ggml-org/llama.cpp, raw.githubusercontent.com/ggml-org/llama.cpp/master/README.m. Fetched 2 Nov 2026.

Know when llama.cpp changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.