NemoClaw Flaw Opens Local AI Agents to Browser-Based Attacks

Researchers at Cyera have uncovered a vulnerability in Nvidia's NemoClaw that could let an attacker seize control of a developer's local AI model server through nothing more than a visit to a malicious webpage. The attack, which exploits a technique called DNS rebinding, gives unauthenticated access to the Ollama server running on the victim's machine, allowing the attacker to implant instructions that persist across conversations.

DNS Rebinding Breaks the Local Wall

The root of the problem lies in how NemoClaw sets up its networking. NemoClaw is designed to run the OpenClaw AI agent inside Nvidia's OpenShell sandbox, which itself runs inside a Docker container. For local inference, NemoClaw can use Ollama, allowing models to run on the developer's own machine rather than sending prompts and code to a cloud service.

Because the container can't reach an Ollama service listening only on the loopback address 127.0.0.1, NemoClaw starts Ollama with 'OLLAMA_HOST=0.0.0.0:11434,' making it listen on all network interfaces. That solves the container connectivity problem but disables an important Ollama protection: the API does not require authentication and normally uses CORS and Host-header checks to prevent unauthorized browser access. When bound to a non-loopback address, Ollama skips its Host-header validation.

An attacker can exploit this by using DNS rebinding, where a malicious webpage first resolves to the attacker's server and then resolves to 127.0.0.1 or a local network address. The browser still thinks the requests belong to the attacker-controlled hostname, but Ollama receives them, resulting in unauthenticated access to the local API.

A Decade-Old Trick, New Target

The technique itself isn't novel. As Randolph Barr, Chief Information Security Officer at Cequence Security, put it: "The individual pieces here aren't new. DNS rebinding's been a browser party trick for over a decade, but pointing it at an unauthenticated local model server is the new part."

Cyera's research details what an attacker can do once they gain access: enumerate installed models and Ollama's version, retrieve model details and system prompts, delete models, or download large models to consume disk space. The impact goes beyond simple disruption — it opens the door to persistent manipulation of the AI model itself.

The Poisoned Template That Persists

The more serious threat emerges after the attacker gains API access. Cyera tested injecting malicious instructions through Ollama's model configuration. A straightforward system-prompt injection wasn't enough because OpenClaw supplies its own system prompt when communicating with the model. Instead, the researchers targeted the model's chat template — the layer that controls how messages are presented to the model.

By modifying the chat template, an attacker could preserve the model's original behavior while appending their own instructions to system messages. Because the modification happens at the model level, the OpenClaw agent doesn't see it and can't override it with its own system prompt. The poisoned template persists across future conversations and remains invisible in the model's ordinary metadata.

The Stakes for Compromised Agents

The real damage depends on what the compromised agent can access. Cyera noted that injected instructions could potentially push the agent toward attacker-controlled packages or URLs, suppress security warnings, introduce vulnerable code, or exfiltrate information through any available network access. For developers running NemoClaw locally, the attack surface includes whatever the agent is allowed to touch — potentially including source code, credentials, or other sensitive data.

Research and Response

The research was conducted by Cyera, which is in the process of acquiring Oasis Security. Elad Luz, head of research at Oasis Security, explained the significance of the flaw in a statement: "With CVE-2026-65105, an attacker can alter how NemoClaw's model reads every message it's handed — one layer beneath anything a guardrail or an operator can see — and the change survives every future session, leaving an integrity problem that's very hard to detect."

He added: "The broader trend is that agents are becoming identities with real entitlements, and we're still securing them like tools."

Nvidia has patched the flaw for non-Windows systems. After this article was published, an Nvidia spokesperson provided a statement: "We appreciate the researchers' discovery and report. Their work shows how open-source development fosters transparent collaboration across the ecosystem to test software limits, rapidly identify and patch vulnerabilities to strengthen agentic cybersecurity. Nvidia has issued an update that customers can download and install."

Why It Matters for Developers

This research points to a growing gap between how AI agents are built and how they're secured. As agents gain access to more system resources and become more integrated into development workflows, the trust we place in local endpoints may no longer hold. The attack doesn't require credentials or prior access — a single visit to a malicious webpage is enough to initiate the DNS rebinding sequence, making this a low-barrier threat.

For developers using NemoClaw or similar tools, the key takeaway is that local AI services are only as secure as the network they're bound to. The fix for this specific flaw is available, but the underlying issues — unauthenticated local APIs, permissive network bindings, and the difficulty of detecting model-level manipulation — are likely to persist across other tools and frameworks. This could mean that as AI agents evolve into more capable and autonomous systems, they also become more attractive targets for attack.