An urgent flaw—tagged CVE-2026-65105—has been discovered in NVIDIA’s NemoClaw that allows attackers to take control of AI agents merely by enticing a user to visit a malicious website. Once the victim browses the site, an attacker could hijack the Jellyfish AI agent setup via NemoClaw and persistently poison model behavior. The issue stems from how NemoClaw configures the Ollama local model server. By default, it launches Ollama bound to 0.0.0.0:11434, making it accessible from any network interface instead of just localhost. Though the startup messages imply the service is limited to the loopback address, Ollama is unintentionally exposed more broadly.
How the Attack Works
The vulnerability becomes exploitable through a technique known as DNS rebinding. An attacker first instructs a victim’s browser to load a domain that resolves to a public server under the attacker’s control. Once loaded, the domain’s DNS record is altered to point to 127.0.0.1 (localhost) or another local IP. Because browsers tie web origins to domain names rather than IP addresses, JavaScript from that page stays trusted and can make same-origin requests even after the domain flips to a local address.
In this scenario, these requests can access Ollama’s unauthenticated API on port 11434. Through it, an attacker can manipulate the AI infrastructure—issuing model generation and deletion commands, changing configurations, forcing user sign-outs, or harvesting metadata. Most damning is model template poisoning, where attackers insert hidden instructions into system prompts so future agent behavior is modified surreptitiously, even if the user sets their own prompts. The corrupt template embeds malicious directives that run during message rendering, influencing output without altering visible settings like the model’s name or size.
Impacts and Mitigations
A compromised model inside NemoClaw could quietly start recommending insecure code, skip warnings, suggest harmful packages, or leak sensitive data. Even though OpenShell’s sandboxing restricts direct access to the host machine, access to other resources—source repositories, CI/CD systems, internal APIs, and communications tools—remains a serious concern. The researchers responsible for uncovering the flaw have already notified NVIDIA’s security team.
To reduce the risk, operators should double-check that Ollama isn’t exposed beyond the loopback interface—ensuring agreement between actual exposure and what’s displayed. Lock down network access to port 11434, monitor any changes to model templates, and treat local inference servers with the same scrutiny as public-facing services. Recognizing that even a single website visit can trigger persistent compromise elevates the need for tighter controls.
This vulnerability joins a growing list of cases proving that model agents and local inference setups are not automatically secure simply because they run on your machine. As AI deployments proliferate, the attack surface expands, especially for tools like NemoClaw that blur lines between local and network exposure. Developers and security teams need to adopt more rigorous default configurations, harden interfaces both exposed and hidden, and rethink trust boundaries. What to watch next: patches from NVIDIA to ensure correct host binding, improved host header validation, and whether downstream tools following similar patterns share hidden risks.
