NVIDIA NemoCLAW Critical Flaw Lets Attackers Hijack AI Agents

Key Takeaways

• A critical vulnerability, CVE-2026-65105, has been discovered in NVIDIA NemoClaw.
• The flaw allows attackers to hijack AI agents by exploiting the local Ollama model server after a user visits a malicious website.
• The vulnerability stems from an insecure default configuration in NemoClaw that exposes Ollama on all network interfaces.
• Attackers can leverage DNS rebinding to access Ollama’s unauthenticated API, enabling model poisoning and data exfiltration.
• NVIDIA has been notified, and users are advised to review network configurations and apply mitigations.

A severe vulnerability within NVIDIA NemoClaw could enable threat actors to seize control of AI agents. The flaw, designated CVE-2026-65105, carries a critical CVSS score and permits persistent manipulation of an AI model’s behavior following a victim’s visit to a specially crafted malicious website. This exposure targets the local Ollama model server utilized by NemoClaw.

NemoClaw serves as NVIDIA’s framework for deploying the OpenClaw AI agent within an OpenShell sandbox environment. It leverages Ollama for local inference, allowing developers to execute large language models directly on their own systems. This capability bypasses the need to transmit prompts and source code to external, cloud-hosted AI services, offering enhanced privacy and control.

According to Cyera, the root cause of the vulnerability lies in NemoClaw’s default configuration for Ollama. To facilitate communication between an OpenShell Docker container and Ollama running on the host, NemoClaw initializes the Ollama service with the environment variable OLLAMA_HOST=0.0.0.0:11434. This setting forces Ollama to bind to all available network interfaces rather than exclusively to the secure local loopback address. While the initial setup message might indicate Ollama is accessible only on localhost:11434, the service is, in fact, exposed more broadly across the network.

Furthermore, this specific configuration can inadvertently disable Ollama’s Host header validation. This validation mechanism is a browser-centric security feature designed to prevent unauthorized access to local services from untrusted websites.

NVIDIA NemoClaw Vulnerability Explained

Cyera researchers detail how attackers can combine this network exposure with a technique known as DNS rebinding. In a typical DNS rebinding attack, a malicious website initially resolves to a public server controlled by the attacker. Once the victim navigates to this site, the attacker manipulates the domain’s DNS response, causing the same hostname to subsequently resolve to 127.0.0.1 or another local IP address on the victim’s machine.

Browsers maintain a security principle where website origins are tied to hostnames, not their resolved IP addresses. Consequently, JavaScript executing within the malicious webpage can continue sending “same-origin” requests even after the domain begins resolving to the victim’s local machine. In the vulnerable NemoClaw configuration, these requests can directly reach Ollama’s unauthenticated API on port 11434. This grants the attacker unauthorized access to critical endpoints, including those for model generation, chat completions, model downloads, deletion, and configuration modifications.

The potential ramifications are extensive, encompassing GPU resource abuse, disk exhaustion through the download of massive models, deletion of existing local models, forced sign-outs from Ollama accounts, and the collection of sensitive model metadata. This exposed information can include model names, versions, templates, system prompts, hostnames, and public keys. The most critical risk identified is model template poisoning.

According to Cyera research, Ollama models incorporate a “template” that translates structured chat messages into the raw text processed by the model. By illicitly modifying this template via the exposed API, an attacker can surreptitiously inject malicious instructions into every subsequent system prompt fed to the model. This method of compromise is more insidious than a simple system-prompt overwrite. While OpenClaw can supply its own system prompt during agent interactions, potentially overriding a model-level system prompt, a poisoned template operates during the message rendering phase. This allows it to append malicious directives even when the AI agent attempts to enforce its own security guidelines.

A compromised model could covertly manipulate an AI agent into generating vulnerable code, suppressing critical security warnings, recommending malicious software packages, or exfiltrating sensitive data to attacker-controlled infrastructure. Crucially, this malicious behavior can persist across numerous future conversations, all while the model’s name, size, and visible settings appear unchanged. Although OpenShell sandboxing can limit direct access to the host system, it does not mitigate the fundamental risk posed by a compromised AI agent.

AI agents frequently possess approved access to vital organizational resources such as source code repositories, CI/CD systems, cloud services, internal APIs, communication platforms, and management servers. This extensive access defines the true impact and potential damage of an agent takeover. The researchers responsibly disclosed the vulnerability to NVIDIA’s Product Security Incident Response Team prior to public disclosure.

What You Should Do

• Immediately review your NemoClaw and Ollama configurations to ensure that port 11434 is not exposed beyond the local loopback address (127.0.0.1).
• Implement strict network access controls and firewall rules to restrict inbound connections to Ollama’s port 11434 from external networks.
• Actively monitor for any unauthorized changes to Ollama model templates or configurations.
• Treat local inference servers, especially those running critical AI models, as highly sensitive security boundaries requiring robust protection.
• Consider running Ollama in a dedicated, isolated environment with minimal network exposure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.