Security researchers find flaw letting any website hijack NVIDIA's local AI agent tool

A security flaw in NVIDIA's NemoClaw framework allowed an ordinary webpage to reach into a developer's computer, take over the local AI model running there, and quietly rewrite its instructions — all without the user clicking anything beyond a normal page visit, according to research published Tuesday by Oasis Security.

The vulnerability, tracked as CVE-2026-65105 and rated 8.1 out of 10 in severity, sits in NemoClaw, an open-source reference stack NVIDIA released this year to help developers run autonomous AI agents such as OpenClaw more safely on their own machines. The tool is meant to sandbox those agents. Instead, researchers found, a default misconfiguration exposed the local model server to the open internet.

How the attack works

NemoClaw runs its local inference engine, Ollama, and binds it to the network address 0.0.0.0:11434 rather than restricting it to the machine itself. That setting exposes the model's control API to any device that can reach it, including, through a technique called DNS rebinding, a browser tab open to an unrelated website.

Once connected, researchers Elad Luz and Ofek Itach of Oasis Security showed that an attacker can call the API's /api/show endpoint to pull down the model's existing chat template, insert hidden instructions into it, and push the altered version back through /api/create. The template is the layer that formats every message before it reaches the model, so the injected text is silently applied to every subsequent conversation the victim has with the agent — not just the one open at the time of the attack.

DNS rebinding, the technique that makes the attack possible from an ordinary browser tab, works by exploiting how browsers treat a website's domain name rather than the underlying network address as the security boundary. A malicious page can register a domain that initially resolves to a normal external server, then rapidly switch its DNS record to point at an address on the victim's own local network — such as the one NemoClaw's server listens on — while the browser continues to treat requests to that domain as safe. Because the browser never re-checks whether the new address is actually the same server it first connected to, script running on the page can then reach services on the victim's machine that were never meant to be exposed to the open internet.

"Sandboxing protects the endpoint, but taking over the agent takes over its access and tools," Oasis Security researchers wrote in their disclosure.

Not ordinary prompt injection

Security researchers have spent two years warning about prompt injection, in which malicious text tricks a model within a single exchange. Oasis argues this is something structurally different. Because the poisoned instructions live in the template rather than in any one conversation, they survive across sessions, override system prompts the user supplies afterward, and remain invisible to anyone inspecting the API's normal output.

• Attack requires only that the victim's browser load a malicious or compromised page while NemoClaw's local server is reachable.
• Exploitation grants full unauthenticated access to the model API: attackers can enumerate installed models, extract system prompts, run inference, delete models or alter configurations.
• Because AI agents are increasingly wired into source control, CI/CD pipelines and internal tools, a hijacked agent can hand attackers a path into those connected systems.
• The underlying weakness echoes CVE-2024-28224, an Ollama DNS-rebinding bug patched in 2024, that NemoClaw's default setup effectively reopened.

Who is exposed, and NVIDIA's response

Oasis said it reported the flaw to NVIDIA's Product Security Incident Response Team before publishing, following standard responsible-disclosure practice, and included a proof-of-concept demonstration. NVIDIA shipped NemoClaw version 0.0.35 with a fix for macOS and Linux installations. Windows and WSL users are not fully covered: version 0.0.34 added only a warning during installation on that path, and a separate proxy update on August 10 introduced a bind-check that blocks non-loopback backends by default but does not reach the Windows configuration and can be switched off with an environment variable.

NemoClaw has been in early preview since mid-March, and NVIDIA's own documentation describes it as not yet production-ready, with interfaces still subject to change. That has not stopped rapid adoption among developers experimenting with always-on coding and research agents, the exact audience the tool targets. No exploitation of the flaw in the wild had been reported as of Tuesday.

The 8.1 severity score, on the industry-standard 10-point Common Vulnerability Scoring System scale, reflects that the flaw requires no authentication, no special privileges and only minimal user interaction — simply loading a web page — while granting an attacker broad control over the target system. Vulnerabilities in that range are typically treated by enterprise security teams as requiring immediate patching rather than routine scheduled maintenance.

Reaction and what comes next

The disclosure lands as security vendors race to define defenses for a wave of autonomous AI agents now given persistent access to developer machines and corporate systems. Oasis Security itself is the subject of a pending $1 billion acquisition by data-security firm Cyera, announced last month, underscoring how quickly investment has moved into securing non-human and AI identities.

Independent outlets including The Hacker News and SiliconANGLE covered the findings within hours of publication, and researchers elsewhere in the security community described the template-poisoning technique as a preview of a broader category of attacks likely to target other local-inference tools that expose management APIs by default. Developers running NemoClaw on Windows or WSL were advised to manually restrict Ollama's network binding to localhost until a complete fix ships, and organizations piloting local AI agents more broadly were urged to audit what network interfaces those agents' inference servers are actually listening on.