A single visit to a malicious website can give attackers control over Nvidia's NemoClaw AI agent by exploiting a vulnerability in its local Ollama model server, according to research published by Cyera. The flaw, tracked as CVE-2026-65105, allows attackers to gain unauthenticated access and inject instructions into the model that remain hidden and persist across all future conversations. Nvidia has now issued a patch for non-Windows systems.
The attack works by exploiting a DNS rebinding vulnerability combined with NemoClaw's network configuration. Because NemoClaw runs its OpenClaw AI agent inside a Docker container sandbox, it cannot reach an Ollama service that listens only on the loopback address 127.0.0.1. To solve this connectivity issue, NemoClaw starts Ollama with "OLLAMA_HOST=0.0.0.0:11434," binding it to all network interfaces. This configuration disables Ollama's Host-header validation, which normally prevents unauthorized browser access alongside CORS protections. An attacker can use DNS rebinding to make a malicious webpage initially resolve to their own server, then subsequently resolve to 127.0.0.1 or a local network address. The browser treats the requests as belonging to the attacker-controlled hostname, but Ollama receives them, granting unauthenticated access to the local API. Cyera researchers found that attackers could enumerate installed models and Ollama's version, retrieve model details and system prompts, delete models, download large models to consume disk space, and otherwise manipulate the local installation.
The more severe threat comes after API access is obtained. According to Elad Luz, head of research at Oasis Security, "an attacker can alter how NemoClaw's model reads every message it's handed — one layer beneath anything a guardrail or an operator can see — and the change survives every future session." Rather than injecting instructions into the system prompt, which OpenClaw would override with its own prompt, researchers targeted the model's chat template instead. This layer controls how messages are presented to the model, and modifications made at this level remain invisible to the OpenClaw agent. The poisoned template preserves the model's original behavior while appending attacker-controlled instructions to system messages, the researchers found. Because the modification occurs at the model level, it persists across future conversations and remains invisible in the model's ordinary metadata.
The potential impact depends on what the compromised agent can access. Cyera researchers said injected instructions could potentially steer an agent toward attacker-controlled packages or URLs, suppress security warnings, introduce vulnerable code, or exfiltrate information through available network access. Randolph Barr, Chief Information Security Officer at Cequence Security, noted that while DNS rebinding has existed for over a decade, "pointing it at an unauthenticated local model server is the new part." Nvidia acknowledged the discovery in a statement, saying the work "shows how open-source development fosters transparent collaboration across the ecosystem to test software limits, rapidly identify and patch vulnerabilities to strengthen agentic cybersecurity," and confirmed an update is now available for customers to download and install. Luz emphasized that "agents are becoming identities with real entitlements, and we're still securing them like tools." The challenge for enterprise security teams is that attacks operating beneath the application layer demand architectural review, not just input filtering. Organizations deploying local AI agents may need to reconsider whether convenience features that expose internal APIs justify the integrity risks they introduce.