Executive Overview

Researchers at Oasis Security have disclosed a critical security vulnerability within NVIDIA NemoClaw, an open-source reference stack engineered to orchestrate AI agents inside OpenShell sandboxes. The flaw enables an external, attacker-controlled webpage to gain unauthenticated control over local instances of the Ollama AI model server.

By weaponizing this access, an unauthenticated threat actor can manipulate the underlying model’s core behavior, planting persistent, hidden instructions directly inside the AI model’s chat templates. These poisoned templates survive across separate user sessions, operate invisibly to API consumers, and bypass standard client-side detection mechanisms.

While patches have been partially rolled out for macOS and Linux environments starting with version v0.0.35, implementations running on Windows and Windows Subsystem for Linux (WSL) remain exposed. This disparity highlights persistent structural challenges in securing local-first AI development toolchains, where containerized workflows, network binding configurations, and web-to-local communication pathways intersect.

Detailed Chronology & Technical Mechanics

1. The Network Exposure: Binding to 0.0.0.0

The attack vector originates from how NVIDIA NemoClaw initializes its local AI inference backend. According to the Oasis Security advisory, NemoClaw launches Ollama by binding the model server explicitly to every available network interface using the configuration parameter OLLAMA_HOST=0.0.0.0:11434.

While this configuration is often recommended in documentation to facilitate seamless integration within containerized environments and WSL2, it exposes the unauthenticated port 11434 beyond the secure local loopback (127.0.0.1), making the API accessible to local applications and browsers operating on the host machine.

2. Exploiting the Gap: CORS and DNS Rebinding

Ollama’s local API relies primarily on middleware defenses—specifically Host header checks and Cross-Origin Resource Sharing (CORS) policies—to prevent browser-originated requests from interacting with the daemon.

However, security researchers identified a fatal logic flaw in how these defenses handle non-loopback addresses:

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
  • Host Header Bypass: When the Ollama daemon is bound to a non-loopback address (such as 0.0.0.0), the server-side validation check for the Host header is bypassed entirely.
  • CORS Exploitation: The CORS layer processes incoming web requests as "same-origin" because both the Origin and Host headers reflect the domain controlled by the attacker when a user visits a malicious website.
  • DNS Rebinding: Attackers leverage DNS rebinding techniques to bridge the gap. The adversary’s domain initially resolves to their external remote server before rapidly pivoting to 127.0.0.1. The victim’s browser continues to treat subsequent requests as trusted same-origin traffic, effectively granting the malicious webpage unrestricted read and write privileges over the local Ollama API port.

This entire attack chain was successfully validated by Elad Luz, Head of Research at Oasis Security, who tested the exploit against macOS-based systems running Firefox and vulnerable iterations of NemoClaw.

3. Payload Injection via Model Templates (/api/create)

Once unauthorized API access is established, the attacker utilizes Ollama’s /api/create endpoint to overwrite or modify the model’s underlying Go chat templates.

In Large Language Models (LLMs), chat templates dictate how structured message arrays are transformed into raw text tokens before being ingested by the neural network. By injecting malicious formatting instructions directly into this template layer, the attacker ensures that hidden system instructions are automatically appended to every future user interaction and system prompt.

Because this manipulation occurs at the model template level—a property completely invisible to downstream API clients and end users—the compromised agent cannot detect, audit, or prevent the tampering. The injected instructions persist indefinitely across system restarts, model reloads, and unrelated conversation sessions.

Supporting Context & Metrics

The Precedent of CVE-2024-28224

The exploitation of Ollama through DNS rebinding is not entirely unprecedented. On March 14, 2024, Ollama introduced patches in version v0.1.29 to mitigate a documented DNS rebinding vulnerability cataloged as CVE-2024-28224 and analyzed extensively by NCC Group. That advisory mandated strict server-side validation of Host headers to restrict communication strictly to authorized local origins.

However, Oasis Security’s findings reveal a critical implementation gap: Ollama automatically disables its Host header verification logic whenever the daemon is bound to a non-loopback address—precisely the configuration enforced by default across multiple NVIDIA NemoClaw installation paths.

Industry Trend: Poisoned Chat Templates and Agent Hijacking

This vulnerability underscores a rapidly growing attack surface within the AI agent ecosystem. Security researchers have tracked an alarming rise in attacks targeting local-first development infrastructure:

  • Cursor AI Code Editor: Discovered vulnerabilities allowing malicious local scripts to interact with development tooling.
  • Paperclip AI Flaws: Exploits reported earlier in the month enabling unauthorized arbitrary code and instruction execution.
  • ClawJacked Vulnerabilities: Documented attacks in February targeting local OpenClaw agents through browser-to-localhost communication channels.

Oasis Security emphasized the severity of the threat in their report: "Sandboxing protects the endpoint, but taking over the agent takes over its access and tools." Even when robust operating system-level sandboxing (such as OpenShell) is active, compromising the AI model core allows malicious actors to hijack the agent’s extended capabilities, local file access, and connected enterprise tools.

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Official Responses and Remediation Status

Vendor Disclosure and Response

Oasis Security coordinated its findings with NVIDIA’s Product Security Incident Response Team (PSIRT) prior to public disclosure. Because the vulnerability stems from architectural design choices and third-party integration patterns rather than a single software bug, no official Common Vulnerabilities and Exposures (CVE) identifier was assigned. As of August 25, 2026, no active in-the-wild exploitation has been formally reported.

Patch Availability by Operating System

Remediation efforts have yielded mixed results depending on the host operating system:

  • macOS and Linux: NVIDIA addressed the vulnerability in NemoClaw v0.0.35, which introduces safeguards against unauthorized remote or web-based bindings on these Unix-like systems.
  • Windows and WSL: As of late August 2026, no native fix is available for Windows hosts and Windows Subsystem for Linux (WSL) deployment paths. Version v0.0.34 introduced a Windows installation path that features a security warning rather than a structural code fix.

Deep-Dive into Repository Commit 17f0ca3b

A code review of the NemoClaw open-source repository conducted on August 25, 2026 (at commit 17f0ca3b), revealed that NVIDIA attempted to mitigate the issue via updates introduced in version v0.0.106 on August 10.

The updated local Ollama proxy now explicitly refuses to launch if the backend model server is bound to a non-loopback network interface. Upon initiation, the proxy terminates execution and emits a diagnostic warning:

"Refusing to start: an Ollama daemon reachable on a non-loopback interface bypasses the proxy’s token check entirely. Set OLLAMA_HOST=127.0.0.1:$port on the Ollama systemd unit or set NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1 to override (not recommended)."

Despite this protection, security analysts noted several limitations with this defense:

  1. The check can be completely bypassed by manually defining the environment variable NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1.
  2. The proxy check fails to execute on platforms where the startup probe cannot run.
  3. Because NemoClaw does not initialize the local proxy along WSL deployment paths, the v0.0.106 security default fails to reach Windows-host environments where the hazardous 0.0.0.0 binding remains active.
  4. The codebase currently lacks any form of chat-template integrity verification; the /api/show endpoint is queried solely to retrieve model context lengths and declared tool-calling capabilities, leaving the template layer entirely unmonitored.

Future Outlook & Recommendations

As generative AI agents transition from experimental toys to autonomous enterprise assistants with deep system integrations, securing the underlying infrastructure becomes paramount. The NemoClaw disclosure demonstrates that traditional perimeter defenses—such as network-level firewalls or local OS sandboxes—are insufficient if local web servers open unsecured communication channels accessible via standard web browsers.

Actionable Recommendations for Developers and Administrators:

  1. Enforce Loopback Binding: Operators must manually ensure that environment configurations explicitly restrict Ollama to the local loopback interface by setting OLLAMA_HOST=127.0.0.1:11434, avoiding generic bindings like 0.0.0.0 wherever feasible.
  2. Upgrade Software Stacks: Immediately update NemoClaw installations to version v0.0.35 or later across all supported macOS and Linux environments.
  3. Exercise Caution on Windows/WSL: Organizations utilizing NemoClaw on Windows hosts or WSL environments should treat their Ollama instances as untrusted until an official, comprehensive patch is released by NVIDIA. Administrators should restrict browser activity while running local agent workloads to minimize DNS rebinding risks.
  4. Implement Template Monitoring: AI infrastructure developers should adopt cryptographic hashing or strict validation checks for model chat templates and configuration files to detect unauthorized persistence mechanisms.