A newly disclosed vulnerability in NVIDIA's NemoClaw agent toolkit allows attackers to permanently poison local AI models by simply tricking users into visiting a malicious webpage, with no malware download required. The flaw, tracked as CVE-2026-65105, exposes the underlying Ollama inference engine to DNS rebinding attacks, enabling attackers to inject hidden instructions into model templates that survive even the agent's own safety guardrails.

NemoClaw is NVIDIA's framework for running OpenClaw-class AI agents locally on developer machines and edge devices using Nemotron language model weights. The vulnerability isn't a flaw in the AI model itself, but rather a networking misconfiguration: the Ollama backend binds to 0.0.0.0:11434 by default, making it accessible to any device on the local network and vulnerable to browser-based DNS rebinding attacks.

How Does the Attack Actually Work?

Researchers at Cyera and Oasis Security demonstrated a four-step attack chain that requires nothing more than a developer visiting a compromised webpage while NemoClaw is running. First, the attacker's webpage performs DNS rebinding to redirect 127.0.0.1 traffic to the victim's machine. Next, the page calls the unprotected Ollama API to enumerate available models and pull version information. The attacker then injects malicious text directly into the model's chat template. Finally, when the developer returns to their AI agent, responses include the attacker's hidden instructions, and this poisoning persists across all future conversations.

What makes this attack particularly dangerous is that template poisoning sits below the agent's system prompt layer. This means guardrails defined in files like CLAUDE.md or AGENTS.md may not detect the compromised instructions, allowing attackers to influence agent behavior in ways that bypass traditional safety checks.

Because NemoClaw binds Ollama for container reachability, the API is also exposed to any device on the local area network without requiring DNS rebinding. This means LAN neighbors could directly access port 11434 as an unauthenticated endpoint, even without visiting a malicious webpage.

What's the Real-World Impact for Developers?

The vulnerability creates a hidden persistence mechanism that could cause AI agents with sufficient permissions to generate backdoored code, weaken security controls, or exfiltrate data while concealing the malicious instructions from users. For organizations shipping NemoClaw blueprints to customers, this means they are effectively shipping inference surface area that could be compromised without their knowledge.

Firefox on macOS and Linux systems were confirmed vulnerable to the proof-of-concept attack before patches were released. Dark Reading and The Hacker News independently verified the exploit's success.

What Has NVIDIA Done to Fix This?

NVIDIA released NemoClaw version 0.0.35 for macOS and Linux, which addresses the Ollama exposure issue. However, Windows and Windows Subsystem for Linux (WSL) installations remain problematic. Version 0.0.34 added only a warning for Windows users rather than fixing the underlying configuration. Version 0.0.106 later introduced a default proxy check that refuses to start when the Ollama backend is bound to a non-loopback interface, providing stronger protection going forward.

NVIDIA published Security Bulletin 5872 listing 19 CVEs related to NemoClaw and OpenShell, though detailed vulnerability descriptions and remediation guidance were not immediately available in the public repository.

Steps to Secure Your NemoClaw Deployment

• Verify Ollama binding: Run the command "lsof -i:11434" to check your current configuration. Production machines should bind only to 127.0.0.1, not 0.0.0.0. You can enforce this by setting the environment variable OLLAMA_HOST=127.0.0.1:11434 before starting Ollama.
• Upgrade immediately: Update NemoClaw to version 0.0.35 or later on macOS and Linux. Windows and WSL users should assume their systems remain exposed until NVIDIA confirms a full patch and should not expose port 11434 to any network.
• Add authentication: Place a reverse proxy with token-based authentication in front of Ollama, even on localhost machines where multiple users have access. This prevents unauthorized API calls from other processes or network neighbors.
• Firewall your LAN: Block inbound traffic on port 11434 at the network level for developer laptops on office Wi-Fi. This prevents LAN neighbors from accessing the unauthenticated Ollama endpoint.
• Re-pull models if compromised: If you suspect your system was targeted, re-download all models from trusted sources. The attacker's proof-of-concept included APIs for model manipulation, so existing weights may have been altered.

Compliance teams evaluating NemoClaw for production pilots should add network hardening requirements to their security checklists, not treat it as optional.

Is This a Broader Problem With Local AI?

This vulnerability highlights a fundamental trade-off in local-first AI stacks: while running models locally eliminates cloud API risks, it introduces host networking risks that developers may not anticipate. The attack surface isn't the AI model itself, but the infrastructure that serves it.

Other backends beyond Ollama were not in scope for this CVE, but security researchers recommend auditing any local OpenAI-compatible API port for similar misconfigurations. Browser-dependent DNS rebinding attacks vary by browser DNS cache behavior, but LAN access to unauthenticated ports does not require any browser tricks.

No widespread exploitation of this vulnerability has been reported in the wild yet, but the risk is significant among early NemoClaw adopters who may not have hardened their network configurations.

NVIDIA also disclosed a separate high-severity arbitrary code execution vulnerability, CVE-2026-65081, affecting the NemoClaw installation process on Linux. This flaw could execute untrusted code and potentially enable privilege escalation, data tampering, and information disclosure. Organizations should apply NVIDIA updates and use hardened installation practices to mitigate both vulnerabilities.