{"id":9232,"date":"2026-08-26T11:35:43","date_gmt":"2026-08-26T11:35:43","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9232"},"modified":"2026-08-26T11:35:43","modified_gmt":"2026-08-26T11:35:43","slug":"nemoclaws-ai-can-be-poisoned-through-a-browser-tab","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9232","title":{"rendered":"NemoClaw\u2019s AI can be poisoned through a browser tab"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A vulnerability affecting Nvidia\u2019s NemoClaw could let an attacker gain control of the local Ollama model server through a single malicious website visit on the victim\u2019s machine.<\/p>\n

According to a Cyera research<\/a>, the flaw could give attackers unauthenticated access to the server, allowing them to plant instructions into the model that persist across future conversations. The attacker doesn\u2019t directly connect to the victim\u2019s Ollama server from the internet. Instead, the malicious webpage tricks the browser into reaching the locally running Ollama API through DNS rebinding<\/a>.<\/p>\n

Once that happens, the model\u2019s chat template, a layer that controls how messages are presented to the model, is manipulated to add malicious instructions to the agent\u2019s system prompts.<\/p>\n

\u201cWith CVE-2026-65105<\/a>, an attacker can alter how NemoClaw\u2019s model reads every message it\u2019s handed \u2014 one layer beneath anything a guardrail or an operator can see \u2014 and the change survives every future session, leaving an integrity problem that\u2019s very hard to detect,\u201d said Elad Luz<\/a>, head of research at Oasis Security, which is being acquired<\/a> by Cyera. \u201cThe broader trend is that agents are becoming identities with real entitlements, and we\u2019re still securing them like tools.\u201d<\/p>\n

The flaw has now been patched by Nvidia for non-Windows systems.<\/p>\n

<\/a>DNS Rebinding breaks Ollama out of local walls<\/h2>\n

NemoClaw<\/a> is designed to run the OpenClaw<\/a> AI agent inside Nvidia\u2019s OpenShell sandbox. For local inference, NemoClaw can use Ollama, allowing models to run on the developer\u2019s own machine rather than sending prompts and code to a cloud service.<\/p>\n

The problem starts with networking. Because the OpenShell sandbox runs inside a Docker container, it cannot reach an Ollama service listening only on the loopback address, 127.0.0.1. NemoClaw therefore starts Ollama with \u201cOLLAMA_HOST=0.0.0.0:11434,\u201d making it listen on all network interfaces.<\/p>\n

That solves the container connectivity problem but also disables an important Ollama protection. Ollama\u2019s API does not require authentication and normally uses CORS and Host-header checks to prevent unauthorized browser access. But when Ollama is bound to a non-loopback address, its Host-header validation is skipped.<\/p>\n

An attacker can then use DNS rebinding to make a malicious webpage initially resolve to the attacker\u2019s server and subsequently resolve to 127.0.0.1 or a local network address. The browser would still consider the requests to belong to the attacker-controlled hostname, but Ollama would receive them, resulting in unauthenticated access to the local API.<\/p>\n

\u201cThe individual pieces here aren\u2019t new,\u201d said Randolph Barr<\/a>, Chief Information Security Officer at Cequence Security. \u201cDNS rebinding\u2019s been a browser party trick for over a decade, but pointing it at an unauthenticated local model server is the new part.\u201d<\/p>\n

Cyera found that an attacker could enumerate installed models and Ollama\u2019s version, retrieve model details and system prompts, delete models, download large models to consume disk space, and otherwise manipulate the local Ollama installation.<\/p>\n

<\/a>The poisoned template refuses to go away<\/h2>\n

The more serious problem is what happens after API access is obtained.<\/p>\n

Cyera tested injecting malicious instructions through Ollama\u2019s model configuration. A straightforward system-prompt injection<\/a> was not enough because OpenClaw supplies its own system prompt when communicating with the model. The researchers thus targeted the model\u2019s chat template instead.<\/p>\n

Modifying the template could let the attacker preserve the model\u2019s original behavior while appending their own instructions to system messages. Because the modification was done at the model level, the OpenClaw agent does not see it and cannot override it with its own system prompt.<\/p>\n

The poisoned template persists across future conversations and remains invisible in the model\u2019s ordinary metadata, the researchers found.<\/p>\n

The exposure depends on what the compromised agent is allowed to access. Cyera said injected instructions could potentially push an agent toward attacker-controlled packages or URLs, suppress security warnings, introduce vulnerable code, or exfiltrate information through available network access. <\/p>\n

NemoClaw version 0.0.35 carries patches for macOS and Linux systems, while Windows\/WSL remains unfixed. Nvidia did not immediately respond to CSO\u2019s request for comments.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A vulnerability affecting Nvidia\u2019s NemoClaw could let an attacker gain control of the local Ollama model server through a single malicious website visit on the victim\u2019s machine. According to a Cyera research, the flaw could give attackers unauthenticated access to the server, allowing them to plant instructions into the model that persist across future conversations. […]<\/p>\n","protected":false},"author":0,"featured_media":9233,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9232"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9232"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9232\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9233"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}