ANALYSIS A near-billion-dollar raise for an AI guardrails vendor, a critical vulnerability in NVIDIA's agent infrastructure, and the first confirmed multi-agent cyberattack on a nation-state all surfaced within the same news cycle — evidence that AI model security is crossing from research concern to funded infrastructure category.
The AI industry spent the past two years racing to ship agents that can act autonomously — writing code, querying APIs, managing infrastructure. The evidence packet shows that the attack surface those agents create is now being exploited in the wild, disclosed by researchers, and capitalized by investors in the same news cycle. The defense side of AI is no longer a feature request; it is a balance-sheet line item.
The big picture
Alice, the Tel Aviv and New York–based company previously known as ActiveFence, raised $140 million led by Apax Digital Funds at a valuation "close to $1B"3. The company sells adversarial testing and guardrails for AI models, counting frontier labs and large enterprises as customers1. Its AI security business has grown more than 500%. With this round, Alice has raised a total of $280 million from investors4.
The same day Alice's raise was reported, researchers at Oasis Security disclosed CVE-2026-65105, a vulnerability in NVIDIA's NemoClaw — the deployment wrapper for the OpenClaw AI agent ecosystem6,7. The flaw can be triggered by a single visit to a malicious website2. NemoClaw starts Ollama with the flag OLLAMA_HOST=0.0.0.0:11434, binding the inference server to every network interface rather than only the loopback address9. Ollama's API on port 11434 does not require authentication. Attackers can combine this exposure with DNS rebinding to bypass the browser's same-origin policy and gain full API access — the ability to enumerate installed models, pull or push arbitrary models, and delete existing ones10.
The most serious risk is model template poisoning. By modifying the chat template through the API, an attacker can inject hidden instructions into every future system prompt sent to the model. A poisoned template runs during message rendering and can append malicious instructions even when the AI agent supplies its own security guidance. The malicious behavior can persist across future conversations while the model name, size, and visible settings remain unchanged. A compromised model could quietly influence an AI agent to generate vulnerable code, suppress security warnings, recommend malicious packages, or send sensitive data to attacker-controlled infrastructure.
Oasis reported the vulnerability to NVIDIA's Product Security Incident Response Team before publishing11. The research is also the first from the team since Cyera agreed in July to buy Oasis for a reported $1 billion.
Meanwhile, the threat is no longer theoretical at the nation-state level. Over four days in early July 2026, a near-autonomous AI framework deployed up to eight parallel sub-agents to breach government infrastructure in Asia, extracting more than 2,564 personnel records, 85 cracked credentials, and critical details about internal network architecture5. Dream Research Labs disclosed the operation on August 12, describing it as the first confirmed instance of a multi-agent AI system successfully executing cyber operations against nation-state infrastructure. The framework was built on components from the Hermes and OpenClaw agent platforms.
ANALYSIS The NemoClaw vulnerability and the multi-agent government breach share a common thread: OpenClaw components appear in both the defensive toolchain NVIDIA built and the offensive framework that breached government systems. That dual-use reality is precisely the market condition Alice is raising capital to address.
The NemoClaw flaw is notable not because it is a model-level weakness but because it is a deployment configuration choice — binding to 0.0.0.0 instead of 127.0.0.1 — that neutralizes every sandbox guarantee NVIDIA's OpenShell was designed to provide. OpenShell sandboxing can limit direct access to the host, but it does not remove the risk created by a compromised agent. Agents may still have approved access to source repositories, CI/CD systems, cloud services, internal APIs, communication tools, and MCP servers. ◆ The attack surface is not the model weights; it is the plumbing around them.
Alice's more-than-500% growth rate and near-$1 billion valuation signal that buyers — frontier labs and enterprises — are already spending on AI-specific defenses, not waiting for standards bodies or regulators to define the category.
What's next
Organizations using NemoClaw with Ollama should review whether port 11434 is exposed beyond loopback, restrict network access, monitor model template changes, and treat local inference servers as sensitive security boundaries. ANALYSIS The convergence of a billion-dollar acquisition of Oasis by Cyera, Alice's $140 million raise, and confirmed autonomous agent attacks on government targets suggests that AI model security infrastructure will attract further capital and consolidation in the near term — driven not by forecasts but by exploits already in the field.