You visit a website. Nothing downloads. No pop-up, no permission request, no alert. And yet, the AI agent sitting on your machine just got hijacked.
That is the scenario Oasis Security demonstrated this week when it disclosed CVE-2026-65105, a vulnerability in NVIDIA's NemoClaw agent toolkit. The attack requires exactly one thing from the victim: opening a malicious webpage in a browser. Everything else is automatic.
What Is NemoClaw?
NVIDIA launched NemoClaw at its GTC conference in March 2026 as a reference stack for building AI agents that run inside sandboxed environments. The idea is straightforward: give your agent a sandbox (OpenShell), a model backend (Ollama for local inference), and a set of tools, and let it work.
NemoClaw is popular with developers who want to keep their AI workflows local. Instead of sending prompts to a cloud API, the agent runs its model on the developer's own GPU through Ollama. The assumption is that local means private and safe.
Oasis Security just proved that assumption wrong.
The DNS Rebinding Attack Chain
The vulnerability exists in how NemoClaw configures Ollama on Windows and WSL (Windows Subsystem for Linux). It launches Ollama with the environment variable OLLAMA_HOST=0.0.0.0:11434, which binds the model server to every network interface instead of just localhost.
Ollama's API on port 11434 has no authentication. It relies on two middleware checks to block unauthorized requests: a Host header validation and a CORS (Cross-Origin Resource Sharing) allowlist. But when the bind address is not loopback (127.0.0.1), the Host header check is skipped entirely.
That leaves the CORS check, and DNS rebinding walks right around it. Here is how the attack works:
- The attacker serves a webpage on port 11434 of a domain they control
- The victim visits the page in their browser
- The attacker's domain re-resolves from their server to 127.0.0.1
- The browser treats the requests as same-origin (same hostname, different IP)
- Requests land on the victim's local Ollama instance
The attacker now has full, unauthenticated API access to the model server.
Model Poisoning: The Worst-Case Scenario
Full API access alone is dangerous. An attacker can enumerate installed models, read system prompts, extract the machine's hostname and public key, or delete models outright. But the real prize is model poisoning.
Oasis Security researcher Elad Luz and his team went deeper than simple prompt injection. They knew that injecting a hidden system prompt would not survive because OpenClaw sends its own system prompt that overrides it.
So they targeted Ollama's /api/create endpoint, which accepts a chat template field. The template is a Go template that renders the message list into the raw text the model reads. The attack chain:
- Pull the model's existing template via
/api/show - Splice a hidden instruction into the template
- Write it back via
/api/create
Every message the client sends now passes through the attacker's modified template, including the agent's own system prompt. The hidden instruction reaches the model after the legitimate prompt, effectively hijacking every response.
From the outside, nothing looks wrong. The model's name, size, and metadata all read as normal. Opening a new chat clears nothing. The payload lives in the model definition itself, well below the conversation state an operator can reset.
What Can a Poisoned Agent Do?
The implications are severe. An instruction sitting in the chat template can:
- Tell the agent to write vulnerabilities into code that passes casual review
- Instruct it to stay quiet about security problems it discovers
- Push conversation contents to an outside endpoint for exfiltration
- Manipulate any tool the agent has access to, including file systems and APIs
As Luz put it, the change sits "one layer beneath anything a guardrail or an operator can see," leaving an integrity problem that is extremely hard to detect.
Why Sandboxing Does Not Help
This is the part that should concern every team running AI agents. NemoClaw's entire value proposition is sandboxing: OpenShell fences off the file system, network, and processes the agent can touch.
But the sandbox does not protect against this attack because the vulnerability is in the model backend, not the agent itself. As Oasis Security noted: "Sandboxing protects the endpoint, but taking over the agent takes over its access and tools."
Randolph Barr, CISO at Cequence Security, put it bluntly: "The individual pieces here aren't new. DNS rebinding has been a browser party trick for over a decade. But pointing it at an unauthenticated local model server is the new part, and it's a good preview of where agentic AI risk actually lives. It's not really in the model; it's in the plumbing around it."
The Fix and What It Means for Your Stack
NVIDIA released NemoClaw v0.0.35, which fixes the issue on macOS and Linux by keeping Ollama on loopback (127.0.0.1) behind a token-gated reverse proxy. On Windows and WSL, v0.0.34 added a Windows installation path that carries a warning instead of a full fix.
Collin Hogue-Spears at Black Duck Software offered the clearest guidance: "Local describes where the model runs. Private describes who can reach it."
If your team runs AI agents locally, here is what to check today:
- Update NemoClaw to v0.0.35 or later on macOS and Linux
- Verify Ollama binding — ensure it is on 127.0.0.1, not 0.0.0.0
- Add Host header validation — check against an allowlist of authorized values
- Audit your agent stack — any local model server exposed to non-loopback interfaces is a target
- Monitor model integrity — compare chat templates and model hashes against known-good baselines
The Bigger Picture
This vulnerability is a preview of the security challenges that come with agentic AI. As developers move from cloud-only inference to local and hybrid deployments, the attack surface expands in ways that traditional security models do not cover.
The sandbox protects the endpoint. The guardrail protects the conversation. But neither protects the model itself from being silently rewritten by a single webpage visit.
For organizations building on AI agent frameworks, the lesson is clear: treat your local model infrastructure with the same rigor you apply to your production servers. Because in an agentic world, a compromised model is a compromised everything.