A vulnerability in Nvidia Corp.'s NemoClaw lets an attacker seize full control of the local model server powering a developer's AI agent — triggered by a single visit to a malicious website1.
The flaw, tracked as CVE-2026-65105, was disclosed on August 25 by researchers at nonhuman identity security company Oasis Security Ltd.. Oasis reported the vulnerability to Nvidia Corp.'s Product Security Incident Response Team before publishing. The disclosure is also the first from the Oasis research team since Cyera agreed in July to acquire Oasis for a reported $1 billion.
Nvidia Corp. released NemoClaw at its GTC conference in March as a safer way to run agents such as OpenClaw. The agent operates inside an OpenShell sandbox, which restricts access to the file system, network, and processes. NemoClaw can run the agent's model locally through Ollama rather than calling a cloud service.
The attack chain exploits how NemoClaw configures Ollama at launch. Docker containers have no path to 127.0.0.1, where Ollama binds by default. NemoClaw launches Ollama with the flag OLLAMA_HOST=0.0.0.0:11434, exposing port 11434 on every interface — meaning other devices on the same network segment can reach it — while the install message still reads localhost:11434.
Ollama's API has no authentication. The researchers found that a Host header check is skipped entirely whenever the bind address is not loopback. DNS rebinding can then bypass the remaining origin check, routing browser requests from the victim's machine to the exposed Ollama instance.
With full API access, an attacker can enumerate installed models, extract the machine's hostname and public key, or delete models outright. Oasis considers model poisoning the worst outcome. OpenClaw sends its own system prompt, which overrides a hidden system prompt baked into the model. Ollama's /api/create endpoint accepts a template field; an attacker can pull the model's existing template through /api/show, splice a malicious instruction into it, and write it back. Every subsequent message the client sends then passes through the attacker's modified version, including the agent's own system prompt with the hidden instruction appended.
A payload embedded in the model definition survives a fresh chat session and sits below the conversation state an operator can reset. An instruction in that position can direct the agent to write vulnerabilities into code, suppress security warnings, or exfiltrate conversation contents to an external endpoint.
Ollama previously hardened against a related class of browser-to-local-service exposure in 2024 under CVE-2024-28224. NemoClaw's current design now refuses a non-loopback Ollama backend on covered topologies.
ANALYSIS The attack surface here is notable because it subverts the sandbox model NemoClaw was specifically designed to enforce: the agent's isolation is intact at the process level, but the model server it depends on is reachable and unauthenticated. The persistence mechanism — injecting instructions into the model template rather than the conversation — means a compromise outlasts the session-level controls a developer would typically rely on to reset state.