Researchers at nonhuman identity security company Oasis Security Ltd. today disclosed a vulnerability in Nvidia Corp.’s NemoClaw that hands an attacker full control of the local model server powering a developer’s AI agent.
The vulnerability, tracked as CVE-2026-65105, can be triggered by one visit to a malicious website. Oasis reported it to Nvidia’s Product Security Incident Response Team before publishing. The research is also the first from the team since Cyera Inc. agreed in July to buy Oasis for a reported $1 billion.
Nvidia released NemoClaw at its GTC conference in March as a safer way to run agents such as OpenClaw. The agent sits inside an OpenShell sandbox, which fences off the file system, the network and the processes it can touch.
NemoClaw can run the agent’s model locally through Ollama instead of calling out to a cloud service. Ollama is the server an attacker ends up controlling. Reaching it from inside the sandbox takes some work.
Docker containers have no path to 127.0.0.1, and that’s where Ollama binds out of the box. NemoClaw launches Ollama with the flag OLLAMA_HOST=0.0.0.0:11434. Port 11434 goes live on every interface. Other devices on the same network segment can hit it too, and the install message still reads localhost:11434.
Ollama’s application programming interface has no authentication. Two middleware checks stand in for it, an origin allowlist and validation of the Host header. The researchers found the Host check is skipped entirely whenever the bind address is not loopback.
That leaves the origin check, and DNS rebinding walks around it. An attacker points a domain they control at their own server and serves the victim a page on port 11434. The domain then re-resolves to 127.0.0.1. Same-origin policy keys on the hostname, not the address behind it, and the browser does not object. Requests from the page land on the Ollama instance running on the victim’s machine.
Full API access alone lets an attacker enumerate what is installed, lift the machine’s hostname and public key or delete models outright. Model poisoning is the one Oasis considers worst.
Injecting a hidden system prompt into the model does not survive contact with the agent, because OpenClaw sends its own system prompt and that overrides the one baked in. So the researchers went a layer lower. Ollama’s /api/create endpoint also accepts a template field. The value is a Go template, and it renders the message list into the raw text the model reads. An attacker can pull the the model’s existing template through /api/show, splice an instruction into it and write it back.
Every message the client sends then passes through the attacker’s version, including the agent’s own system prompt, which reaches the model with the hidden instruction appended. From the outside nothing looks wrong. Name, size and metadata all read as normal. Opening a fresh chat clears nothing. The payload lives in the model definition, well below the conversation state an operator can reset.
An instruction sitting in that position can tell the agent to write vulnerabilities into code that passes casual review, to stay quiet about security problems or to push conversation contents to an outside endpoint.
Elad Luz, head of research at Oasis, said the change sits “one layer beneath anything a guardrail or an operator can see” and leaves an integrity problem that is very hard to detect. The sandbox does not help much, he said, because the blast radius of an AI system is its authorizations rather than its isolation. A video published alongside the paper walks through the full chain, from malicious website to a poisoned agent answering with the attacker’s marker.
Discussing the report, Randolph Barr, chief information security officer at API security and bot management provider Cequence Security Inc., said the target matters more here than the technique.
“The individual pieces here aren’t new, DNS rebinding’s been a browser party trick for over a decade but pointing it at an unauthenticated local model server is the new part, and it’s a good preview of where agentic AI risk actually lives,” Barr said in commentary provided to SiliconANGLE. “It’s not really in the model; it’s in the plumbing around it. Sandboxing the agent doesn’t buy you much if the thing it’s built on top of is reachable from any tab in the browser.”
Collin Hogue-Spears, senior director of solution management at application security testing company Black Duck Software Inc., noted that Ollama hardened this class of browser-to-local-service exposure back in 2024 under CVE-2024-28224. NemoClaw’s current design refuses a non-loopback Ollama backend on covered topologies, he said. Anyone still on the older pattern should keep Ollama on loopback behind an authenticated proxy and check the Host header against an allowlist.
“Local describes where the model runs,” Hogue-Spears added. “Private describes who can reach it.”