NVIDIA NemoClaw Flaw Lets Attackers Hijack AI Agents With One Website Visit

A critical vulnerability in NVIDIA NemoClaw that could let attackers hijack an AI agent after a victim visits a malicious website. The issue, tracked as CVE-2026-65105, can expose the local Ollama model server used by NemoClaw and allow persistent poisoning of the AI model’s behavior.

NemoClaw is NVIDIA’s tool for deploying the OpenClaw AI agent inside an OpenShell sandbox. It can use Ollama for local inference, allowing developers to run language models on their own systems instead of sending prompts and source code to cloud-hosted AI services.

According to Cyera, the problem begins with how NemoClaw configures Ollama. To let an OpenShell Docker container connect to Ollama running on the host, NemoClaw starts the service with OLLAMA_HOST=0.0.0.0:11434.

This makes Ollama listen on every network interface rather than only on the local loopback address. Although the setup message tells users that Ollama is available on localhost:11434, the service is actually exposed more broadly.

This configuration can also turn off Ollama’s Host header validation, a browser-focused safeguard intended to prevent untrusted websites from accessing local services.

NVIDIA NemoClaw Vulnerability

Cyera researchers said attackers can combine this exposure with DNS rebinding. In this attack, a malicious website first resolves to an attacker-controlled public server.

After the victim opens the site, the attacker changes the domain’s DNS response so that the same hostname points to 127.0.0.1 or another local address.

Because browsers associate website origins with hostnames rather than resolved IP addresses, JavaScript running in the malicious page may continue sending same-origin requests after the domain begins resolving to the victim’s local machine.

In the vulnerable configuration, those requests can reach Ollama’s unauthenticated API on port 11434. The attacker could then access endpoints for model generation, chat completions, model downloads, deletion, and configuration changes.

This may enable GPU abuse, disk exhaustion through large model downloads, deletion of local models, forced Ollama account sign-outs, and collection of model metadata.

Exposed information can include installed model names, versions, templates, system prompts, hostnames, and public keys. The most serious risk is model template poisoning.

According to Cyera research, Ollama models can include a template that converts structured chat messages into the text processed by the model. By modifying this template through the API, an attacker can inject hidden instructions into every future system prompt sent to the model.

This differs from a simple system-prompt overwrite. OpenClaw can provide its own system prompt during agent interactions, potentially replacing a model-level system prompt.

A poisoned template, however, runs during message rendering and can append malicious instructions even when the AI agent supplies its own security guidance.

A compromised model could quietly influence an AI agent to generate vulnerable code, suppress security warnings, recommend malicious packages, or send sensitive data to attacker-controlled infrastructure.

The malicious behavior can persist across future conversations while the model name, size, and visible settings remain unchanged. OpenShell sandboxing can limit direct access to the host. However, it does not remove the risk created by a compromised agent.

AI agents may still have approved access to source repositories, CI/CD systems, cloud services, internal APIs, communication tools, and MCP servers. That access defines the real impact of an agent takeover. The researchers reported the flaw to NVIDIA’s Product Security Incident Response Team before publication.

Organizations using NemoClaw with Ollama should review whether port 11434 is exposed beyond loopback, restrict network access, monitor model template changes, and treat local inference servers as sensitive security boundaries.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post NVIDIA NemoClaw Flaw Lets Attackers Hijack AI Agents With One Website Visit appeared first on Cyber Security News.