Overview
In August 2026, Oasis Security disclosed a high-severity vulnerability in NVIDIA’s NemoClaw framework (CVE-2026-65105, CVSS 3.1 score 8.1). The vulnerability allows an attacker to fully take over a locally running Ollama model service and implant persistent hidden instructions into the AI model via a single malicious webpage and without any user awareness. As of the disclosure date, no reports of the vulnerability being exploited in real-world attacks have been found.
Background of the Vulnerability
The root cause of the vulnerability lies in a specific configuration strategy NemoClaw adopted to bridge its containerized sandbox with the host network. NemoClaw is NVIDIA’s open-source reference stack for deploying AI agents such as OpenClaw within the OpenShell sandbox environment. To support local inference, NemoClaw uses Ollama as one of its inference backends. The OpenShell sandbox runs inside a Docker container, while Ollama by default listens only on the 127.0.0.1 loopback address, which prevents the container from accessing it directly. To solve this connectivity problem, NemoClaw starts Ollama on the Windows host with OLLAMA_HOST=0.0.0.0:11434, binding it to all network interfaces. This change exposes an API that was previously restricted to the local loopback — and has no authentication — to any device that can reach the machine’s IP address and port. More concerning still, during installation NemoClaw continues to display the message “Using Ollama on localhost:11434” to developers, which easily creates the false impression that the service remains protected.
Attack Chain
The attacker’s actions can be summarized as three progressive stages.
Stage One: Browser-Side Bypass and Local API Access
After the victim opens a webpage controlled by the attacker, JavaScript on the page launches a DNS rebinding attack. The script first resolves the attacker-registered domain to the attacker’s own server, which passes the browser’s same-origin check; it then switches the DNS record to 127.0.0.1. Because the browser uses the domain name as the basis for same-origin determination, subsequent requests are still treated as same-origin, thereby bypassing CORS restrictions. At the same time, because Ollama is bound to 0.0.0.0, the API’s Host-header validation is also skipped. In this way, the script gains unauthenticated access to the local Ollama API.
Stage Two: Model Template Retrieval and Poisoning
The attacker calls the /api/show endpoint to obtain the current model’s chat template structure, and uses it to construct a tampered Go template that appends a hidden instruction after every system message in the original template. The attacker then writes this modified template into the model definition via the /api/create endpoint. Because this operation acts on a model-level property rather than conversation-level content, it leaves no obvious trace during normal interaction.
Stage Three: Persistent Control Takes Effect
From this point on, every turn and every new session with this model will automatically execute the attacker’s implanted hidden instruction at inference time. Even if the agent sends its own system prompt, the tampered template will still append the attacker’s instruction after the system message. Because the template is a static, model-level attribute, it is completely invisible to API callers — clients can neither detect nor prevent this behavior.
Poisoning, however, is only one of many capabilities this vulnerability grants an attacker. Once DNS rebinding succeeds, the attacker effectively gains unrestricted access to all of Ollama’s API endpoints, meaning they can also carry out a much broader range of malicious actions — inference abuse, resource exhaustion, information theft, and even account takeover.
| Operation Category | Method | Endpoint | Specific Impact |
|---|---|---|---|
| Inference Abuse | POST | /api/generate | Run arbitrary prompts on the victim’s GPU, consuming compute |
| POST | /api/chat | Execute chat completions on the victim’s hardware | |
| POST | /v1/chat/completions | Perform inference calls via the OpenAI-compatible interface | |
| Destructive Operations | POST | /api/create | Overwrite an existing model or modify its configuration (used for poisoning) |
| POST | /api/pull | Download arbitrary models, potentially filling up disk space | |
| POST | /api/push | Push a model to ollama.com, potentially impersonating the victim’s account | |
| DELETE | /api/delete | Delete the victim’s local model files | |
| POST | /api/signout | Force the victim to sign out of their ollama.com account | |
| Reconnaissance | GET | /api/tags | Retrieve the names, sizes, families, and quantization levels of all installed models |
| GET | /api/version | Retrieve the exact Ollama version number, enabling targeted attacks | |
| POST | /api/show | Fully export model details, including system prompts, templates, license, etc. | |
| POST | /api/me | Retrieve the machine hostname and public key; leaks the username if logged in |
Overview of API operations available to the attacker
Threat and Impact Assessment
The destructive potential of this attack manifests across several dimensions.
First, its stealth is extreme. The victim only needs to browse a webpage; the entire attack completes silently in the background, with no pop-ups and no errors. The tampered model template does not change the model’s name, size, or other metadata, and leaves no identifiable anomaly in conversation logs or system logs, making it difficult for both operations staff and end users to detect.
Second, its persistence is notable. Traditional prompt injection only affects a single session and becomes ineffective once that session ends; template poisoning, by contrast, is a structural change at the model-definition layer. The poisoned template automatically appends the hidden instruction to every subsequent inference request, and cannot be removed across sessions, restarts, or model reloads. No system-prompt reset or conversation cleanup can clear this backdoor.
Third, the risk of privilege abuse is substantial. AI agents are typically granted high-risk permissions such as code execution, file read/write access, and access to source-code repositories and cloud service credentials. Sandboxing only protects the host from being damaged by the agent — but here the attacker does not need to break out of the sandbox at all; instead, they take over the agent itself directly, thereby inheriting all of its tools and permissions. Combined with the destructive and reconnaissance operations listed in the table above, the attacker can build a more complete attack chain, causing more severe resource damage or data exfiltration. A covertly hijacked agent could be used to implant vulnerabilities into a codebase, recommend malicious dependency packages, covertly exfiltrate sensitive data, or perform any other action permitted by its privileges.
Case Summary and Security Takeaways
This case reflects a typical dilemma in AI infrastructure security: a configuration decision that trades security for convenience, combined with existing attack techniques, is enough to produce serious security consequences.
Compared with traditional attacks, this one pushes the target from the application layer down to the infrastructure layer. Previous prompt-injection attacks against AI acted only on a single conversational input, with limited impact that could be overwritten by subsequent turns. This attack, however, directly tampers with the chat template at the model-definition layer — equivalent to planting a backdoor at the model’s foundation, affecting every subsequent use of that model. Because the attacker need only take control of the agent inside the sandbox — and does not even need to break out of the sandbox — sandbox isolation is effectively rendered meaningless.
This case is also a reminder for the industry to take seriously the absence of a “secure by default” principle in AI development frameworks. To solve container connectivity, NemoClaw chose to bind to 0.0.0.0 — a decision that achieves its functional goal but reintroduces a previously known vulnerability (CVE-2024-28224). When a development framework lowers its security bar for the sake of convenience, every downstream deployment inherits the corresponding risk. As AI agents are granted increasingly broad system access and tool-calling capabilities, this kind of infrastructure-layer security flaw is bound to trigger even more serious cascading consequences.
References
[1] Oasis Security. Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning. Cyera Research, 2026-08-25. https://www.cyera.com/research/nemoclaw-one-website-visit-to-hijack-your-ai-agent
[2] The Hacker News. A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw. 2026-08-25. https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
[3] Cloud Security Alliance AI Safety Initiative. DNS Rebinding in NemoClaw Enables Persistent Model Poisoning. 2026-08-27. https://labs.cloudsecurityalliance.org/research/csa-research-note-nvidia-nemoclaw-model-poisoning-20260827-c/
[4] 4sysops. NVIDIA NemoClaw flaw could poison local AI agents from a single malicious webpage. 2026-08-25. https://4sysops.com/archives/nvidia-nemoclaw-flaw-could-poison-local-ai-agents-from-a-single-malicious-webpage/
