Nvidia NemoClaw flaw let attackers poison the model behind a developer’s AI agent

Researchers at security company Oasis Security Ltd. have uncovered a flaw in Nvidia's NemoClaw that allows attackers to take control of the model server powering a developer's AI agent. The vulnerability, CVE-2026-65105, can be exploited by visiting a malicious website once. Oasis alerted Nvidia before sharing the findings, which are the first from their team since its acquisition by Cyera in July.

NemoClaw, introduced at Nvidia's GTC conference in March, aims to run AI agents locally using Ollama instead of cloud services. Ollama is the server that attackers gain control over. While Ollama binds to 127.0.0.1 by default, NemoClaw launches it with the flag OLLAMA_HOST=0.0.0.0:11434, making it accessible from any device on the same network.

The API lacks authentication, and researchers found that the Host header check is bypassed when the bind address isn't loopback. This allows DNS rebinding attacks, where the attacker points a controlled domain at their own server and forces the victim's browser to connect to it. With full API access, an attacker can enumerate installed models, extract machine information, or even delete models.

The worst-case scenario is model poisoning, where a hidden system prompt is injected into the model, which can override the agent's system prompt. Although the sandbox provides some protection, the main risk lies in the underlying unauthenticated local model server. Oasis recommends keeping Ollama on loopback behind an authenticated proxy and checking the Host header against an allowlist.