NVIDIA NemoClaw Flaw Let Malicious Websites Hijack Local AI Agents

A single webpage visit was enough to quietly rewrite how a locally running AI agent behaves, according to research Oasis Security published this week. The flaw, now tracked as CVE-2026-65105, sits in NVIDIA’s NemoClaw stack, the open-source reference implementation for running agents like OpenClaw inside NVIDIA’s OpenShell sandboxes. No exploitation has been reported in the wild as of this writing, but the mechanics are the kind of thing defenders should have already flagged if they run local model servers.

The Setup That Made It Possible

NemoClaw launches Ollama, the popular local LLM runtime, with the environment variable OLLAMA_HOST=0.0.0.0:11434. That binds the model server to every network interface on the machine rather than just loopback. Ollama does ship a defense against exactly this kind of exposure: it validates the Host header on incoming requests to block cross-origin access from a browser. Here’s the catch. That validation is skipped entirely whenever Ollama is bound to a non-loopback address. Bind to 0.0.0.0 for convenience, and you’ve turned off the one check designed to stop a browser tab from talking to your local model API.

DNS Rebinding Closes the Loop

Attackers didn’t even need direct network access. DNS rebinding, a technique that’s been around for over a decade in browser security circles, gave them a path in. A malicious domain first resolves to the attacker’s own server so the page loads normally. Once loaded, the DNS record flips to point at 127.0.0.1. Because the browser’s same-origin policy is tied to the hostname rather than the resolved IP, it happily lets the page’s JavaScript keep making requests, now landing on the victim’s own loopback interface where Ollama is listening. With Host header validation disabled by the 0.0.0.0 bind, only CORS stood in the way, and the attacker’s own origin sailed right through it.

Why the Payload Is So Hard to Spot

The interesting part isn’t the network trick, it’s what the attacker does once inside. Rather than injecting a one-off malicious system prompt, which a savvy user or a fresh conversation could wash away, the researchers found the exploit targets Ollama’s /api/create endpoint to modify the model’s chat template itself. That template is a Go/Jinja-style construct applied at inference time to every message that passes through the model, not something surfaced anywhere in the chat UI. Change it once, and every future conversation, across every session, silently carries the attacker’s hidden instruction alongside the user’s real prompt. There’s no log entry in the transcript pointing to it. There’s no system prompt override that clears it. The compromise lives one layer below where most people are looking.

That’s a meaningfully different threat model than the prompt injection incidents this outlet has covered elsewhere. Most of those rely on a document or a tool result carrying the payload into a single session. This one plants itself in the model configuration and just waits.

What’s Fixed and What Isn’t

Oasis Security disclosed the issue to NVIDIA’s PSIRT, and NemoClaw shipped a fix for macOS and Linux in version 0.0.35 that refuses to start against a non-loopback backend. Windows and WSL users are not so lucky. There’s no patched path there yet; the current release just adds a warning during installation instead of closing the hole. Elad Luz, Oasis Security’s head of research, put the practical burden on IT teams plainly: the fix exists, but organizations still have to make sure every end user running NemoClaw locally actually applies it.

The Open Question

What’s genuinely unresolved here is how many other local-agent stacks made the same convenience-over-security tradeoff without anyone noticing. Binding a dev tool to 0.0.0.0 “just to make it easier to test from another device” is a habit baked into a lot of tutorials and default configs, and Ollama isn’t the only inference server whose auth model assumes loopback-only deployment. Until someone does a broader sweep of local AI tooling for this exact pattern, it’s fair to treat this as one confirmed instance of a class of bug, not a one-off.

References

• A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
• Oasis Security Researchers Reveal Security Flaw in NemoClaw AI Agent
• Nvidia NemoClaw flaw let attackers poison the model behind a developer’s AI agent
• Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning
• NVIDIA NemoClaw Flaw Lets Malicious Websites Hijack OpenClaw AI Agents