NVIDIA NemoClaw Flaw Lets a Malicious Webpage Poison the Local AI Model, Oasis Security Says

Security researchers at Oasis Security say a single malicious webpage could quietly take over the local model server that powers an NVIDIA NemoClaw AI agent, then plant hidden instructions inside the model that survive from one conversation to the next. The target is Ollama, the local inference backend NemoClaw can run so an agent answers from the developer's own machine instead of a cloud API. Per the report, that model server's interface can be reached with no authentication, and whoever reaches it can change a model-level setting so every later conversation carries text the operator never wrote and cannot see.

Update (August 26, 2026): NVIDIA has since assigned CVE-2026-65105 (CVSS 8.1, High) to this issue. Fixes are available for the macOS and Linux paths, while the Windows-host and WSL path remains exposed.

Oasis Security disclosed the weakness on August 25, 2026, and says it reported the findings to NVIDIA PSIRT (Product Security Incident Response Team) before going public. As of that date, no exploitation had been reported. The research was shared with The Hacker News ahead of publication and separately covered by SiliconANGLE.

What Oasis Security Disclosed

NemoClaw is NVIDIA's open-source reference stack for running agents such as OpenClaw inside sandboxed environments, and Ollama is one of its supported local inference backends. The problem, according to the report, is not the sandbox but the plumbing underneath it. On one platform path, NemoClaw launches Ollama bound to every network interface (the setting OLLAMA_HOST=0.0.0.0:11434), and the model API listening on port 11434 requires no authentication. When the server is bound that broadly, a browser-origin check that would normally block cross-site requests is skipped, which is what opens the door to an attacker-controlled webpage.

The consequence Oasis Security flags as worst is not data theft but model poisoning. Rather than injecting a system prompt (which the agent overrides with its own), the technique alters the model's chat template, the layer that turns a conversation into the raw text the model reads. Modified once, it appends attacker-supplied text to the agent's own system message every time, so hidden instructions inside the model persist across new chats and are invisible to the client. "The client cannot detect or prevent this," Oasis Security said in the report, because "the template is a model-level property invisible to API consumers." The CyberSignal is pointing readers to the Oasis Security writeup and The Hacker News for the full technical walk-through rather than reproducing the chain here.

What that access buys an attacker is leverage over whatever the agent can touch, the same offensive upside researchers showed when they had AI orchestrate EDR-evasion malware in a lab. An agent wired into source control, cloud accounts, or a build pipeline hands its authorizations to whoever controls the model behind it. As Oasis Security put it, "Sandboxing protects the endpoint, but taking over the agent takes over its access and tools." Elad Luz, the firm's head of research, told SiliconANGLE the change sits "one layer beneath anything a guardrail or an operator can see," which is what makes it hard to detect.

Why a Local Model Server Is a Real Target

The individual moving parts here are old. Binding a local service to 0.0.0.0, skipped Host-header checks, and DNS rebinding to defeat the browser's same-origin rule are all well-documented techniques. Ollama itself patched a DNS-rebinding weakness in its API two years ago, shipped as CVE-2024-28224 in an NCC Group advisory. What is new is the target: pointing that decade-old browser trick at an unauthenticated local model server that an autonomous agent is built on top of.

That is the throughline defenders should sit with. As AI agents move onto the desktop and run their models locally for speed and privacy, they extend the browser-to-localhost attack surface that security teams have spent years trying to close. A model server on 127.0.0.1 feels private because it never leaves the machine, but "local" describes where the model runs, not who can reach it. Any tab the developer has open is a potential path to it. It is the same shape of problem The CyberSignal has tracked as researchers turn AI coding agents against the systems they touch, from guardrail bypasses across open-source coding agents to malicious skills on the OpenClaw marketplace and prompt injection reaching Google Gemini on Android. The trust boundary keeps landing in the same place: around the agent and everything it loads, not just the model.

Is There a CVE, and Has NVIDIA Patched It?

Yes to both, though the patch is only partial. NVIDIA published CVE-2026-65105 on August 25, 2026, classifying the issue as CWE-306 (Missing Authentication for Critical Function) with a CVSS score of 8.1 (High) over an adjacent-network attack vector. The Hacker News, writing from the research as it stood on August 25, said the disclosure "carr[ies] no CVE identifier, no affected version range, and no patched version"; that is no longer the case. SiliconANGLE's coverage links to a different identifier, CVE-2026-25651, which is a mislink and is not the identifier for this vulnerability.

Remediation detail differs by source, so check both. Elad Luz, head of research at Oasis Security, told The Hacker News that NemoClaw v0.0.35 fixed the macOS and Linux paths. On those paths Ollama now stays bound to 127.0.0.1:11434 behind a token-gated reverse proxy on port 11435. There is no fix on the Windows-host and WSL path, which still sets OLLAMA_HOST=0.0.0.0:11434 with no authentication. NVIDIA's own bulletin frames it differently: it lists "NemoClaw for Linux versions 0 through 0.0.25" as affected and associates the fix with commit f06796ff3, tied to version 0.0.25. Because 0.0.25 appears in both the affected and the updated fields, eSecurityPlanet advises verifying the fix by commit rather than by version string. Until NVIDIA ships a Windows and WSL fix, treat that topology as live exposure.

What Defenders Should Do Now

The defensive posture comes down to keeping the local model server off the browser's reach, confirming the NemoClaw build in use, and treating the served model as something whose integrity has to be verified rather than assumed. The checklist below is a same-week pass a security team can run against any host running NemoClaw with a local Ollama backend.

My read: The reported facts above are Oasis Security's; this is The CyberSignal's assessment, not a new finding. The headline risk is not NemoClaw specifically, it is the pattern. Local AI agents expand the browser-to-localhost attack surface, turning an unauthenticated model server into a high-value target that sits one tab away from a compromise. The agent's blast radius is its authorizations, not its isolation, so a sandbox that fences off the file system does little once the model behind the agent is the thing being rewritten. Expect more of this class as agents move on-device, and treat any local inference backend the way you would treat any other unauthenticated service on a developer's machine — that is where securing AI systems starts.

What Is Not Yet Confirmed

Several points remain open. NVIDIA has not published a fix for the Windows-host and WSL path, and the two available remediation references do not line up: Oasis Security points to NemoClaw v0.0.35, while NVIDIA's bulletin cites version 0.0.25 and commit f06796ff3. It is not established whether other Ollama-served agents, beyond NemoClaw, are affected by the same configuration. No victims have been named, and while a demonstration was referenced alongside the research, The CyberSignal has not confirmed the release of a public proof-of-concept exploit. We will update this story as NVIDIA and Oasis Security publish more detail.

Primary Documents

• Oasis Security (Cyera): Drive-By Agent Hijacking — One Website Visit, Persistent Model Poisoning — the original research writeup by Elad Luz and Ofek Itach, published August 25, 2026. Oasis Security is part of Cyera.
• The Hacker News — report received ahead of publication, including Elad Luz's statement that NemoClaw v0.0.35 fixed the macOS and Linux paths and that the Windows and WSL path has no fix.
• eSecurityPlanet — coverage of CVE-2026-65105 (CWE-306, CVSS 8.1) and NVIDIA's bulletin, with the advice to verify the fix by commit f06796ff3 rather than by version string.
• SiliconANGLE — additional coverage with commentary from Oasis Security's head of research. Note that its CVE link resolves to CVE-2026-25651, a mislink that is not the identifier for this vulnerability.
• NCC Group — the 2024 Ollama DNS-rebinding advisory (CVE-2024-28224) that establishes the prior art.