NVIDIA NemoClaw Flaw Lets Attackers Persist Instructions in Ollama Models

A malicious webpage can silently rewrite the instructions baked into your local AI model, and the model will never surface the change. That is the core finding of CVE-2026-65105, disclosed by Oasis Security on August 25, 2026: a configuration flaw in NVIDIA NemoClaw exposes the local Ollama model server to unauthenticated remote access, letting attackers plant persistent instructions that survive across every subsequent conversation.

What NemoClaw Does

NemoClaw is an open-source reference stack for running AI agents, such as OpenClaw, inside sandboxed environments provided by NVIDIA OpenShell. The sandbox restricts what an agent can touch on the host: file system, network, processes. For model inference, NemoClaw supports local LLMs through Ollama, which runs a REST API server on the user’s own hardware. The privacy pitch is straightforward, prompts and data stay on-device. The security flaw is in how NemoClaw hands Ollama its configuration.

The Binding Problem

Ollama was designed as a localhost tool, which historically justified skipping authentication entirely. Move the binding to 0.0.0.0 and the unauthenticated API becomes reachable from the network. NemoClaw’s default configuration does exactly that.

DNS Rebinding as the Attack Vector

Getting a remote webpage to talk to a local service should be blocked by the browser’s same-origin policy. Ollama adds its own defences: origin allowlists and Host header validation. According to Oasis Security’s findings, the Host header check is skipped entirely when Ollama binds to a non-loopback address, leaving only the origin check. DNS rebinding defeats that check. The attacker registers a domain, serves a webpage to the victim, then rapidly flips the domain’s DNS record to resolve to the victim’s local IP. The browser, keying same-origin enforcement on the hostname rather than the underlying IP, treats subsequent requests from that page as same-origin. The local Ollama instance receives them as legitimate API calls.

Persistent Model Poisoning

Once inside, an attacker has full Ollama API access: list models, read system prompts, pull or delete models, run prompts directly on the victim’s GPU. The most damaging move uses the /api/create endpoint to rewrite a model’s chat template. Unlike a runtime system prompt, the chat template is a model-level property. Oasis Security noted it is “invisible to API consumers,” meaning the agent framework layered on top cannot see or override it. Malicious instructions planted in the template persist across every subsequent conversation, active regardless of what system prompt the agent supplies at runtime. The model behaves as instructed while the user sees nothing unusual.

Why the Sandbox Doesn’t Save You

OpenShell’s sandbox limits what the agent can do on the host. It does not limit what a poisoned model will tell the agent to do within those permissions. Oasis Security’s framing is precise: “taking over the agent takes over its access and tools.” If the model has been instructed to leak credentials or generate false outputs, the sandbox’s restrictions on direct system access are beside the point, the agent’s decisions are already compromised.

What Teams Should Do Now

NVIDIA’s NemoClaw v0.0.106, released August 10, 2026, now refuses to start the local Ollama proxy if the backend is not bound to loopback, printing a warning and a remediation path. That covers new installs on the updated version. For anything older, the immediate requirement is an external authentication layer, a bearer-token check or an API gateway, in front of any Ollama instance reachable on a non-loopback interface. Firewall rules and IP allowlists should restrict access to known hosts. The default 0.0.0.0 binding is typically set for Docker convenience, letting containers reach the host’s Ollama server; that convenience comes at a real cost if network isolation is not tight.

Collin Hogue-Spears, senior director at Black Duck Software Inc., drew a clean distinction: “local” describes where the model runs, “private” describes who can reach it. The two are not the same. Teams should audit running instances using tools like Shodan to surface any publicly exposed Ollama servers, and rotate any credentials or API keys that may have been accessible during the exposure window.

The AI Supply Chain Problem

The NemoClaw flaw is a configuration issue, but it points to something structural. Agentic deployments increasingly pull models from public repositories and wire them into systems that touch production infrastructure, cloud credentials and customer data. The model has typically been treated as a static data file, benign by default. CVE-2025-33236 in NeMo, which triggers remote code execution simply by importing a model with a malicious architecture, makes that assumption look untenable. The AI model pipeline is an unmonitored software supply chain, as Cato CTRL framed it in February 2026, with the additional complication that malicious logic can live in learned parameters rather than executable code, which makes it substantially harder to scan for.

Agentic systems amplify the exposure. An agent with tool access and autonomous decision-making, running on a poisoned model, can cause real damage within whatever permissions it holds. The governance gap around AI agent deployments is where that risk lands hardest. Sandboxing, network isolation, data provenance tracking and authentication at every integration point are the baseline for any local LLM deployment that touches anything of value, not optional hardening. Teams building on LLM stacks where flaws resist standard detection methods should treat model provenance with the same scrutiny they apply to third-party code dependencies.