Is KoboldCpp safe to download and run?

Is KoboldCpp safe? Get it from the right place

These are the official places to get KoboldCpp, checked on 14 Nov 2026:

• GitHub releases: github.com/LostRuins/koboldcpp/releases. Binaries come only from here. Our download page links to it.
• koboldcpp.net: a community documentation site that the maintainer confirmed as official in GitHub Discussion #2499 (September 2026).
• Hugging Face: huggingface.co/koboldcpp holds curated models and templates, not the program.
• SourceForge: the README lists a download mirror at sourceforge.net/projects/koboldcpp. We prefer GitHub, which is the source of every file.

koboldcpp.dev is an independent guide. It is not an official site, and it never hosts files.

Fake KoboldCpp sites

The KoboldCpp README calls koboldcpp.com malicious. From the maintainer’s notes in Discussion #2499 and our own checks on 13 Nov 2026:

We have not screenshotted these sites ourselves, because we do not visit them from a test machine, so the table reflects the maintainer’s statements and our header checks. Our list is rechecked monthly.

How to recognise a fake: it makes “official” claims without linking GitHub, shows ad pop-ups, offers an “APK”, or serves a download that is not on github.com. The maintainer reports that pop-ups on these sites push malware when ad blocking is off.

Check that your file is genuine

Every official file has a SHA-256 hash. This table lists the hashes for the current version (1.124.2, from the GitHub release assets F01).

> Get-FileHash .\koboldcpp.exe -Algorithm SHA256

$ shasum -a 256 koboldcpp-mac-arm64

$ sha256sum koboldcpp-linux-x64

Compare the result with the table. PowerShell prints it in capital letters, which is the same value. If it does not match, delete the file and download it again from GitHub. If it still does not match, do not run it.

Why antivirus, SmartScreen or Smart App Control warn

In our own scan, Microsoft Defender (engine 4.18.26100.4, signatures 1.463.283.0, 13 Nov 2026) reported “found no threats” for koboldcpp.exe and koboldcpp-nocuda.exe, and the threat list was empty F38. That is a point-in-time result for those exact files and not a guarantee for future signatures or other products. We did not run other antivirus engines or a VirusTotal lookup.

Why warnings still happen, in our words: the program is a single large self-extracting file, it is not signed with a publisher certificate, and when it starts it unpacks bundled libraries into a temporary _MEI folder. Heuristic scanners dislike that pattern. Users report blocks of koboldcpp_cublas.dll (DLL errors). We have not reproduced a block on a clean Windows 11 yet.

If a warning appears:

1. Check the hash first, above.
2. In Windows Security, open Virus and threat protection, then Protection history, and restore the file only if the hash matched.
3. If you must, add an exclusion for the one folder that holds KoboldCpp, and remove it when you are done.
4. Do not turn antivirus off.

For Smart App Control (WinError 4551), the options and trade-offs are in it won’t start. We could not reproduce it ourselves.

Is it private?

KoboldCpp runs the model on your computer, and chats stay there. Data leaves your PC only when you use something that needs the internet:

• Remote tunnel (--remotetunnel): downloads the cloudflared program and opens a public trycloudflare.com link.
• AI Horde worker or Horde use in Kobold Lite: requests go through the community Horde.
• Web search (--websearch): queries go to DuckDuckGo.
• Model downloads from Hugging Face or links in a template.
• External providers: Kobold Lite can connect to online APIs if you enter one.

We have not yet run a network capture of an idle KoboldCpp (the outbound audit is still to do), so we do not claim that it never makes a connection.

Don’t expose it to the internet by accident

• With no --host, upstream’s flag description says KoboldCpp listens on all interfaces; use 127.0.0.1 to keep it to your PC. Whether another device can reach it also depends on your firewall and router. We have not tested the reachability from a second machine yet.
• A password protects generation, not discovery: in our test, without the key /api/v1/generate and /v1/chat/completions returned 401, but /api/v1/model and the web page stayed reachable F25. The help text adds that image endpoints are not protected.

See remote access for how to set it up safely.

Models are files too

A GGUF model is data, not a program, but download models only from uploaders you trust on Hugging Face. A .kcppt template can point to downloads, so read what it fetches. A shell command in a config (--onready) is ignored when it comes from a config file unless you set --allow-config-onready, so do not turn that on for configs you did not write.