NVIDIA’s NemoClaw agent framework contains a newly disclosed vulnerability that allows a single malicious webpage to take control of the local Ollama model server backing a developer’s AI agent and inject stealthy, persistent instructions into the model’s behavior, researchers at Oasis Security warn.[1][2]
Oasis Security, a firm focused on nonhuman identity security, found that when developers use NemoClaw with Ollama, the platform can launch a local Ollama instance in a way that exposes its HTTP API without authentication, leaving it reachable from the browser.[1][2] The issue, now tracked as CVE-2026-65105, can reportedly be triggered by luring a developer into visiting a booby-trapped webpage, and no in-the-wild exploitation had been reported as of August 25, 2026.[1][2] Oasis says it reported the weakness to NVIDIA’s product security incident response team prior to public disclosure.[2]
According to the research, NemoClaw may start Ollama with an environment configuration such as OLLAMA_HOST=0.0.0.0:11434, binding the model server to all network interfaces rather than just local loopback.[2] Oasis notes that Ollama’s API lacks built-in authentication and instead relies on middleware checks in front-end integrations, including an origin allowlist and a Host header validation step.[1] The investigators found that the Host check is skipped when the bind address is not loopback, leaving only the origin check, which can be bypassed via DNS rebinding so that a browser loaded with a malicious page begins sending requests to the victim’s local Ollama service.[1][2]
Once a victim visits the attacker-controlled site, the page can issue HTTP requests to the exposed Ollama API on the NemoClaw host, giving the attacker effective remote control over the local model server.[1][2] Oasis reports that this access is sufficient to modify Ollama’s chat template so that hidden, attacker-supplied instructions are silently prepended to every subsequent conversation handled by the model, persisting across sessions and tools that rely on that instance.[2] In practice, such prompt poisoning could quietly steer agents to leak sensitive data, manipulate outputs, or favor particular code and content choices while appearing to operate normally from the user’s perspective.
The Ollama integration in NemoClaw is flagged as “experimental” in the Ollama documentation, underscoring that it is not yet treated as a hardened production pathway.[3] NVIDIA’s own NemoClaw security guidance also highlights that network policy and inference authentication are not enforced when agent runtimes are launched outside the platform’s managed gateway paths, and recommends using NemoClaw-managed sandbox entry points for production workloads.[5] Recent NemoClaw release notes describe tighter validation and sandboxing around local Ollama instances and other managed inference providers, including improved health checks and sandbox endpoint verification, although these changes have not been explicitly tied to CVE-2026-65105.[4][6][10]
While SiliconANGLE reports that the newly disclosed bug is tracked as CVE-2026-65105, the original write-up shared with The Hacker News noted the absence of a public CVE entry, affected version range, or patched release from NVIDIA at the time of disclosure.[1][2] Other NemoClaw issues, such as prompt-injection-driven information disclosure (CVE-2026-24222) and a server-side request forgery flaw in endpoint validation (CVE-2026-24231), have already received CVSS scores and remediation guidance in public advisories, with fixes landing in specific NemoClaw versions.[9][11][14] Until NVIDIA publishes concrete fixes and configuration guidance for CVE-2026-65105, defenders using NemoClaw with Ollama are advised to treat the integration as high-risk: restrict or disable browser access on hosts running experimental local agents, ensure local model servers bind only to loopback where possible, keep agent runtimes behind managed gateways, and separate sensitive browsing from development environments that expose local AI infrastructure.
References
- Nvidia NemoClaw flaw let attackers poison the model behind a developer’s AI agent – SiliconANGLE
- A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
- NemoClaw – Ollama documentation
- August 6, 2026 | NVIDIA NemoClaw
- NemoClaw Security Posture and Control Trade-Offs
- Release Notes | NVIDIA NemoClaw
- NVIDIA NemoClaw vulnerability
- August 20, 2026 | NVIDIA NemoClaw
- JVNDB-2026-014093 – JVN iPedia – 脆弱性対策情報 …
- NVIDIA NemoClaw contains a vulnerability in the… · CVE-2026-24231
