A malicious webpage could poison your local AI model behind Nvidia NeMoClaw
Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself. The findings were shared with The Hacker News ahead of publication, and the report says Oasis Security reported them to NVIDIA's Product Security Incident
Source: The Hacker News · August 26, 2026 at 4:31 AM · AI-assisted report
Single-sourceKUALA LUMPUR, 26 AUGUST 2026 —
NVIDIA’s NemoClaw Vulnerability Exposes Local AI Models to Web-Based Attacks, Say Security Researchers
Market Impact
KUALA LUMPUR, Aug 25 (Bloomberg) — A newly disclosed security flaw in NVIDIA’s open-source NemoClaw framework could allow attackers to hijack local AI models by exploiting a malicious webpage, according to a report by Oasis Security shared with The Hacker News. The vulnerability, which has not been assigned a CVE identifier, enables unauthenticated control of a local Ollama instance—an open-source inference engine—used to run AI agents, potentially embedding hidden instructions directly into the model.
Oasis Security reported the issue to NVIDIA’s Product Security Incident Response Team (PSIRT) prior to public disclosure. As of August 25, 2026, no active exploitation has been documented. NemoClaw v0.0.35 addressed the flaw on macOS and Linux, but fixes remain unavailable for Windows and Windows Subsystem for Linux (WSL) environments, where v0.0.34 was released with a warning instead.
NemoClaw serves as NVIDIA’s reference stack for running AI agents such as OpenClaw within OpenShell sandboxes, with Ollama listed as a supported local inference backend. The vulnerability arises from how NemoClaw configures Ollama to bind to all network interfaces (0.0.0.0:11434) rather than the loopback address (127.0.0.1), exposing the API without authentication.
This configuration bypasses standard security checks, allowing an attacker-controlled webpage to modify the model’s chat template via the Ollama API, injecting persistent instructions that influence all subsequent AI responses.
The attack chain leverages DNS rebinding, where an attacker’s domain first resolves to a malicious server and then to 127.0.0.1, tricking the browser into treating requests as same-origin. While Ollama introduced Host header validation in March 2024 (CVE-2024-28224) to mitigate such risks, NemoClaw’s default binding to 0.0.0.0 circumvents this protection. Oasis Security’s head of research, Elad Luz, confirmed that the full exploit chain was tested on macOS using Firefox against a vulnerable NemoClaw version.
Malaysia’s AI Adoption Faces Security Scrutiny For Malaysian enterprises and developers integrating local AI models—particularly in sectors like finance, healthcare, and education—the disclosure underscores critical security considerations. Local AI deployments often rely on open-source frameworks such as Ollama and NemoClaw to reduce cloud dependency and enhance data privacy. However, the exposure of port 11434 to localhost without proper authentication controls introduces risks of model poisoning, where attackers could manipulate AI behavior subtly over time.
NVIDIA’s documentation for Windows-host configurations explicitly warns against exposing port 11434 to local area networks or the internet, addressing external network access. Yet, the DNS rebinding technique bypasses this by exploiting browser-based access from the same machine, making internal systems vulnerable even without direct network exposure. This highlights the need for stricter local endpoint security measures in AI workflows, particularly in environments where sensitive data processing occurs.
Sector and Company Implications
NVIDIA, a key player in Malaysia’s growing AI and semiconductor ecosystem, has yet to issue a public advisory specific to this vulnerability. The company’s open-source tools are widely used by Malaysian tech firms, universities, and government-linked entities for AI research and deployment. The lack of a CVE identifier suggests the issue may not yet be classified as a critical security flaw by global standards, but its potential impact on AI integrity warrants attention.
Oasis Security’s findings follow similar incidents involving local AI model hijacking, including a February disclosure where researchers demonstrated browser-to-localhost attacks on OpenClaw agents. The recurring pattern of chat template poisoning—where hidden instructions persist across model interactions—raises broader concerns about the resilience of open-source AI frameworks against adversarial manipulation.
Outlook: Urgent Patching and Policy Review Needed
Industry experts recommend immediate updates to NemoClaw installations, particularly for macOS and Linux users, while Windows and WSL users remain at risk until a formal patch is released. Developers are advised to bind Ollama to 127.0.0.1 and enforce Host header validation to mitigate DNS rebinding risks. The absence of chat template integrity checks in NemoClaw’s current implementation further emphasizes the need for enhanced validation mechanisms in AI model deployment pipelines.
For Malaysian stakeholders, this incident serves as a reminder of the dual-edged nature of local AI adoption: while it enhances data sovereignty and reduces cloud costs, it also introduces new attack surfaces that require security protocols. As AI integration accelerates across industries, collaboration between tech providers, regulators, and enterprises will be essential to safeguard model integrity and user trust.
Details on NVIDIA’s official response timeline and broader industry impact remain under development.
Related: NVIDIA · Elad Luz · KUALA LUMPUR