A Malicious Webpage Can Poison Your Local AI Model Through NVIDIA NemoClaw

Researchers at Oasis Security have described an attack chain against NVIDIA NemoClaw — an open-source reference stack for running AI agents (OpenClaw, for example) inside OpenShell sandboxes. One of the supported local inference backends is Ollama, and it is precisely its configuration that turned out to be vulnerable. No CVE identifier has been assigned to the finding, and as of August 25, 2026 no cases of exploitation have been recorded.

How the attack works

According to the report, NemoClaw launches Ollama with the OLLAMA_HOST=0.0.0.0:11434 parameter, binding the model server to all network interfaces. The API on port 11434 requires no authentication and relies on two layers of middleware that are supposed to block requests coming from the browser. But when the bind address is not loopback, the Host header check is skipped entirely, while the CORS layer treats the request as “same-origin,” since the Origin and Host headers carry the attacker's own domain.

The remaining gap is closed by DNS rebinding: the attacker's domain first resolves to their server and then to 127.0.0.1, while the browser continues to consider the requests same-origin. Oasis Security's head of research, Elad Luz, verified the full chain on macOS in Firefox against a vulnerable version of NemoClaw.

Curiously, Ollama itself closed this hole back in March 2024 (v0.1.29, CVE-2024-28224) by adding a Host header check. According to Luz, however, that check is disabled as soon as the server is bound to a non-loopback address — and 0.0.0.0 is exactly what NemoClaw sets.

Poisoning the model template

Once it has access to the API, the payload writes a modified Go chat template through /api/create. It is the template that determines how an array of structured messages is turned into raw text before the model processes it; the poisoned version appends attacker-controlled text to every system message during inference.

“The sandbox protects the endpoint, but hijacking the agent means hijacking its access and its tools,” Oasis Security notes. The injected instructions persist across sessions and even outlive the agent's own system prompt. The client, meanwhile, is powerless: “The template is a model-level property, invisible to API consumers.”

What about a fix

According to Luz, version v0.0.35 fixed the problem on macOS and Linux. For the Windows and WSL path there is no fix — there, v0.0.34 merely added installation with a warning. Version v0.0.106 (August 10) introduced a proxy that refuses to start against a backend not bound to loopback, but this check can be disabled with an environment variable, and it does not run on those very WSL and Windows paths where the bind to 0.0.0.0 is set in the first place. No chat template integrity check was found in the repository.

Oasis Security had already demonstrated a similar technique against Paperclip earlier this month, and in February it used a comparable “browser → localhost” path to hijack local OpenClaw agents.

Source: The Hacker News