A newly revealed vulnerability in NVIDIA’s NemoClaw stack could allow a malicious webpage to permanently inject directives into local AI models. Disclosed by researchers at Oasis Security, the bug lets an attacker control an Ollama instance—Nvidia’s supported inference backend—and manipulate its chat template via unauthenticated API access. No public exploits or patches have been issued as of August 25, 2026.
How Local Model Poisoning Works
NemoClaw is an open-source framework from NVIDIA that runs agents like OpenClaw in sandboxed environments. Under normal setups, Ollama, which powers model inference locally, is bound to the loopback address (127.0.0.1) to prevent outside access. However, on Windows hosts using Docker Desktop or on systems using WSL2 containers, NemoClaw sets the binding to 0.0.0.0—making Ollama reachable from any network interface. This configuration lacks authentication for the API listening on port 11434.
This setup allows browser-originated requests to bypass validation checks. The Host header verification gets skipped when not running on loopback, and CORS treats the attacker’s domain as same-origin due to header alignment. Through a DNS-rebinding attack, a malicious domain can first resolve to an external server and then redirect to localhost—all while the browser believes it’s still safe and same-origin. Once accessed, the attacker can alter the chat template using Ollama’s API endpoints. That corrupted template adds hidden instructions to every system message processed, influencing future conversations even if the system prompt is changed, and is invisible to users of the model).
Current State & What’s Being Done
There’s currently no CVE for this issue, nor any confirmation of an affected version range or patch. That leaves users unable to verify if they are vulnerable. Researchers did identify fixes in the NemoClaw repository with the release of version 0.0.106 on August 10, 2026, which introduced a check refusing to start Ollama daemons bound to non-loopback interfaces—prompting for `OLLAMA_HOST=127.0.0.1:port` under most platform paths. Nevertheless, this fix doesn’t apply to the Windows-host configurations where the loophole persists. Operators can still disable the new check via an environment variable, which isn’t recommended.
Also, the codebase lacks any checks to ensure integrity over chat templates: no endpoint or mechanism verifies that those templates haven’t been tampered with after initial setup. Documentation strongly cautions Windows-host users not to expose port 11434 to external network access, which addresses inbound traffic, but it doesn’t defend against attack chains leveraging local browser access and DNS rebinding.
Broader Implications and Similar Threats
This isn’t the first time chat template poisoning has been used to hijack AI agent behavior. Similar attacks were discovered recently against open-source agents like Paperclip, and earlier this year, exploit paths involving browser-to-localhost communications were used to compromise agents based on OpenClaw. What makes this case particularly concerning is the persistence of hidden instructions across sessions and the near-imperceptible nature of the compromise.
For now, users of NemoClaw should ensure they are using version 0.0.106 or newer, verify that Ollama is bound only to the loopback interface, and double-check that no Docker or WSL configurations leave port 11434 exposed without authentication. Monitoring the repository for fixes, and for official security advisories, will be key.
Analysis: This vulnerability highlights a dangerous trade-off when enabling ease of local AI experimentation without tight default security. Making services easily reachable from multiple interfaces or disabling protective layers for convenience often invites exploitation. The lack of a CVE or patch suggests this issue may slip under many radar screens—especially in smaller or self-managed deployments. What to watch: whether NVIDIA issues a patch soon that closes all platform-specific exposure paths; whether standard AI stacks begin integrating template integrity checks by default; and how other AI frameworks defend against browser-to-localhost vectors and DNS rebinding attacks in future agent ecosystems. AI users should treat local inference stacks with the same caution they apply to remote services—privilege erosion is only a bind away.
