Nvidia’s NemoClaw Vulnerability Exposes Local AI Models to Attacks via Malicious Websites

A serious vulnerability in Nvidia's NemoClaw presents an alarming risk: a remote attacker can potentially control the local Ollama model server with just a single visit to a malicious website. This was revealed in recent research by Cyera, which highlighted how the flaw significantly undermines the security of AI agents. The implications of such a breach extend beyond mere system compromise, raising concerns about data integrity and the safety of users who might unknowingly engage with infected AI models.

The Vulnerability Exposed

This vulnerability, identified as CVE-2026-65105, enables attackers to gain unauthenticated access to the local server, facilitating the insertion of malicious instructions that persist across interactions. Interestingly, the attack doesn’t involve a direct connection through the internet; instead, it relies on DNS rebinding techniques to trick the user's browser into redirecting requests to the local Ollama API. This method of attack is particularly troubling because it exploits existing functionalities of web technologies and highlights the gap in security practices around local server management.

How DNS Rebinding Escapes Local Protections

At its core, NemoClaw is designed to run the OpenClaw AI agent securely within Nvidia’s OpenShell sandbox environment. For optimal performance, it integrates with Ollama, allowing models to leverage local machine resources rather than relying on cloud services. However, a networking issue emerges because OpenShell runs within a Docker container, making it unable to connect with Ollama services that are bound solely to the loopback address (127.0.0.1). This limitation, while a technical hiccup, ultimately points to a broader issue of how software containers interact with local systems.

To circumvent this, NemoClaw starts Ollama with the setting “OLLAMA_HOST=0.0.0.0:11434,” effectively rendering it accessible on all network interfaces. That’s where the trouble begins. This adjustment solves the connectivity limitation, but it also disables vital protections inherent to Ollama. Ordinarily, Ollama’s API requires authentication and employs CORS and Host-header checks to thwart unauthorized access. By allowing Ollama to bind to a non-loopback address, the validation of Host headers is bypassed, opening the door to attack. This represents a significant oversight in the security architecture; developers must remain vigilant against the ways that seemingly innocuous changes can create vulnerabilities.

Employing DNS rebinding, an attacker can craft a malicious site that resolves first to their server and subsequently to the local address (127.0.0.1). To the browser, all requests seem to originate from the attacker’s hostname, providing the malicious entity with unauthorized access to the Ollama API. This manipulation blurs the boundaries between trusted and untrusted entities on the web, making it increasingly difficult for users to navigate these risks safely.

“The individual components of this issue aren’t new,” commented Randolph Barr, CISO at Cequence Security. “DNS rebinding has long been a known browser exploit, but utilizing it against unauthenticated local model servers is a novel twist.” His point underscores a concerning trend: hackers are evolving their strategies to exploit pre-existing vulnerabilities in unexpected ways. If you're working in this space, you can't afford to ignore such developments; vigilance is key.

Persistent Threats from Malicious Instructions

The true danger escalates after the attacker gains API access. Cyera conducted tests that revealed a straightforward prompt injection wasn't sufficient due to OpenClaw’s built-in system prompt while communicating with the model. Instead, researchers shifted their focus to manipulating the model’s chat template. This strategy illustrates the nuanced approaches attackers must take when working with sophisticated AI systems, where traditional hack methods might fall short.

By altering this chat template, attackers can append their malicious instructions to the system messages without disrupting the model’s original behavior. This subtlety is alarming because it means a compromised model could continue to operate normally to unsuspecting users while executing hidden, malevolent commands. The reshaped template is positioned at the model level, rendering it undetectable and unalterable by the OpenClaw agent.

This persistent modification can sneak through multiple future interactions, remaining undetected within the model’s standard metadata, the research discovered. The severity of the exposure depends on the permissions granted to the compromised agent; injected instructions could direct the agent to malicious URLs or packages, suppress essential security alerts, incorporate vulnerable code, or extract sensitive information through available network connections. These types of risks require new thinking about security protocols, especially as we integrate AI technology into critical applications.

Company Response and Implications for the Future

Following these revelations, Nvidia confirmed that it has patched the vulnerability for non-Windows systems. An Nvidia representative expressed gratitude towards the researchers for their vital findings, emphasizing how this reinforces the importance of collective contribution in the open-source landscape to enhance software security. But one has to wonder: how many other vulnerabilities lie in wait within widely used software?

For those concerned, Nvidia has rolled out an update that users can now download and install to mitigate the risk associated with this vulnerability. However, it’s crucial to approach these patches with caution. A preemptive attitude towards security needs to permeate through every sector, especially as AI continues to integrate deeper into various applications. What this means for you is simple: constants updates are non-negotiable, as well as keeping an eye on broader security trends.

Looking Ahead: The Need for Stronger Protections

As AI technologies proliferate, the vulnerabilities they introduce will only become more complex. For developers and companies leveraging AI, this incident serves as a stark reminder of the need for stronger protections against vulnerabilities that can exploit fundamental network settings. Users must demand better from software providers regarding security measures embedded in their products. One could argue that we're at a crossroads—either we double down on security architecture or we risk exposing sensitive systems to a crescendo of malicious attacks.

And really, this is the part most people overlook. The obligation of security doesn’t rest solely on identifying existing vulnerabilities. It’s also about anticipating future risks, adapting to the threat environment, and cultivating a culture of security awareness that pervades every aspect of development and usage.