Security researchers have uncovered a critical vulnerability that allows attackers to permanently poison local AI models through a simple website visit, raising urgent questions about the safety of running AI agents on personal devices. The flaw, disclosed by Oasis Security researchers, affects NVIDIA's NemoClaw tool and exposes the underlying Ollama API (a popular platform for running open-source AI models locally) to DNS rebinding attacks. Once compromised, an attacker can inject hidden instructions into a model's chat template that persist across all future conversations, potentially causing the AI to generate backdoored code, weaken security controls, or leak sensitive data without the user ever knowing.

What Exactly Is This Vulnerability, and Why Should You Care?

The attack works through a deceptively simple chain of events. When you configure Ollama to accept connections from any network address (rather than just your local machine), a malicious website can use a technique called DNS rebinding to bypass your browser's security protections and gain direct access to your AI model server. From there, the attacker can enumerate, run, modify, or delete your local models entirely. Most troublingly, they can alter a model's underlying instructions in ways that are invisible to you but shape every response the AI gives.

This matters because the entire appeal of running AI models locally is supposed to be security and privacy. You keep your sensitive documents, financial records, and proprietary data on your own machine instead of uploading them to cloud services. But if an attacker can poison the model itself, that security promise evaporates. An AI agent with sufficient permissions could generate malicious code, exfiltrate data, or weaken your defenses while appearing to work normally.

How Bad Is the Current Situation?

NVIDIA has patched the Ollama exposure in NemoClaw version 0.0.35 for macOS and Linux systems. However, Windows and Windows Subsystem for Linux (WSL) users remain vulnerable. Version 0.0.34 added only a warning for Windows installations rather than a full fix. Additionally, NVIDIA NemoClaw for Linux is affected by a separate high-severity vulnerability (CVE-2026-65081) in its installation process that could allow arbitrary code execution, with a severity rating of 8.1 out of 10.

The good news: there is no evidence that either of these flaws has been exploited in the wild yet. But the existence of the vulnerability highlights a broader tension in the local AI movement. As organizations rush to move AI workloads off the cloud and onto their own infrastructure, they're discovering that local doesn't automatically mean secure.

Why Are Companies Moving AI to Local Machines in the First Place?

The shift toward local AI is being driven by two powerful forces: cost and privacy. Running AI agents in the cloud means paying for every token (a unit of text) the model processes. An agent that runs for hours reviewing documents, verifying its own work, and iterating on analyses can rack up substantial API bills. On a device you already own, the marginal cost of those tokens approaches zero.

For enterprises, this economics is compelling. Organizations implementing local AI agent architectures typically see a 60 to 80 percent reduction in monthly AI API costs by routing 10,000 or more basic operations per day locally, while unlocking the ability to run AI operations on heavily regulated proprietary data that compliance rules forbid sending to third-party providers.

Just this week, Perplexity announced Portable Computer, a fully local version of its AI agent platform developed in partnership with NVIDIA. The system runs entirely on hardware users already own, starting with NVIDIA's DGX Spark desktop supercomputer and Linux machines with NVIDIA RTX GPUs. Work completed locally consumes no billing credits, and the company says every task starts on the device by default, with the system asking permission before sending any individual step to a more powerful cloud model.

How Are Developers Actually Building These Local AI Systems?

The most robust approach involves coupling workflow orchestration tools with local model servers. n8n, a workflow automation platform, has published a detailed integration guide for connecting its system with Ollama. The architecture keeps all requests within your infrastructure: n8n handles the orchestration layer and connects to your tools and triggers, while Ollama operates as a local large language model (LLM) server serving open-weight models like Llama 3.1, Mistral, Qwen, and DeepSeek. No request leaves your infrastructure.

This approach solves two specific operational pain points. First, it shifts high-volume, repetitive classification and extraction tasks off metered APIs to fixed-cost local infrastructure. Second, it enables processing of highly sensitive internal or client data that compliance mandates strictly forbid sending to third-party LLM providers.

Steps to Secure Your Local AI Setup

• Restrict Network Access: Configure Ollama to accept connections only from your local machine (127.0.0.1) rather than from any network address (0.0.0.0). This prevents DNS rebinding attacks from malicious websites.
• Apply Security Updates Immediately: If you use NVIDIA NemoClaw, update to version 0.0.35 or later on macOS and Linux. Windows users should apply version 0.0.34 at minimum and monitor for a full fix.
• Use Hardened Installation Practices: When installing tools like NemoClaw on Linux, follow NVIDIA's security guidance to prevent arbitrary code execution during the installation process.
• Isolate Your Infrastructure: Keep your local AI infrastructure on a separate network segment or machine that doesn't browse the open internet, reducing the attack surface for DNS rebinding and other web-based exploits.
• Monitor Model Integrity: Periodically verify that your model's chat template and system prompts haven't been modified by comparing them against known-good backups.

What Does This Mean for the Future of Local AI?

The vulnerability doesn't invalidate the case for local AI, but it does underscore that moving workloads off the cloud requires security discipline. NVIDIA's Nader, director of developer technology, noted that local AI has reached an inflection point where it's no longer just a hobbyist curiosity. "For the longest time, it was hobbyists and enthusiasts, and they were running these quantized models that were quantized down to be super tiny. And while that's cool, it's not super practical. But all that changed with a lot of these new open source models that have come out that are super useful," he stated.

The challenge now is ensuring that as local AI moves into production environments, the security practices keep pace with the technology. The DNS rebinding vulnerability is fixable, and NVIDIA has already released patches. But it's a reminder that local infrastructure requires active security management, not just a set-and-forget deployment.

For organizations evaluating whether to move AI workloads locally, the answer is increasingly yes, but with caveats. The cost savings and privacy benefits are real and substantial. The security risks are manageable but require attention. As Perplexity's engineering team noted, the key is bundling the entire local AI stack into a single, well-designed system rather than assembling pieces separately, which is historically been "really painful" and error-prone.