As reported by The Hacker News, Oasis Security has disclosed a weakness in NVIDIA's NemoClaw agent stack that allows an attacker-controlled webpage to seize unauthenticated control of a local Ollama instance and permanently alter the model's chat template — effectively poisoning every subsequent conversation the agent conducts. No CVE has been assigned, and no active exploitation has been observed as of August 25, 2026.

AI Security Alert: As reported by The Hacker News, Oasis Security has disclosed a weakness in NVIDIA's NemoClaw agent stack that allows an attacker-controlled webpage to seize unauthenticated control of a local Ollama instance and permanently alter the model's chat template — effectively poisoning every subsequent conversation the agent conducts.

The technical chain is not novel in isolation — DNS rebinding combined with CORS bypass is a well-documented browser attack class — but its application to local AI infrastructure exposes a blind spot that many security teams have not yet mapped: the inference server is now a privileged attack surface, and the model itself is a writable persistence target.

Vulnerability Snapshot

AttributeDetail
ComponentNVIDIA NemoClaw + Ollama local inference backend
Root CauseOllama bound to 0.0.0.0:11434 with no authentication; Host header check skipped on non-loopback binds
Attack VectorDNS rebinding via attacker-controlled webpage
ImpactUnauthenticated API access; chat template modification enabling persistent instruction injection
Patch StatusFixed in NemoClaw v0.0.35 (macOS, Linux); unpatched on Windows/WSL — v0.0.34 ships a warning only
CVENone assigned
Active ExploitationNone reported

Why This Matters Beyond the Advisory

The most consequential insight from this research is not the CORS misconfiguration itself but what it demonstrates about the agent security model. As Oasis Security noted, sandboxing protects the endpoint — but an attacker who controls the agent controls its tools, file access, and downstream actions. Poisoning the chat template is not a transient injection; it is a persistence mechanism. Every future prompt the user sends is silently prepended with attacker instructions. For agentic systems that execute code, browse the web, or manipulate files, this is effectively remote code execution by proxy.

The model is not just an output generator — in an agent stack, it is the decision engine. Compromise the model, and you compromise every tool it can invoke.

Second, the platform divergence is a governance problem. The fact that macOS and Linux received a fix while Windows and WSL users operate with only a warning means security teams cannot rely on version numbers alone. A Windows host running v0.0.35 — nominally the 'latest' — may still carry the vulnerable binding path. Asset inventories and patch verification must account for platform-specific remediation, not just semantic version checks.

Who Is Most Exposed

Why This Matters Beyond the Advisory
Developer workstations on Windows/WSL2 running NemoClaw with Ollama — the unpatched path with the widest attack surface
Research and prototyping environments where local LLM agents have broad tool access (shell, file system, browser automation)
Any deployment following Ollama's own documentation advising OLLAMA_HOST=0.0.0.0 for WSL2 or containerized setups without additional network controls
Shared or multi-user development hosts where one compromised browser session can poison inference for all users

Shield53 Recommendations

Immediate Actions

  • Verify your bind address: Confirm Ollama is bound to 127.0.0.1:11434, not 0.0.0.0. If container access is required, use a token-gated reverse proxy on a separate port rather than exposing the raw API.
  • Patch macOS and Linux hosts to NemoClaw v0.0.35 immediately. For Windows/WSL deployments, treat the instance as exposed until a fix ships — restrict network access at the host firewall level.
  • Block port 11434 at the host firewall for all non-loopback traffic. On Windows, use Windows Defender Firewall rules to explicitly deny inbound on 11434 from non-local origins.
  • Deploy DNS rebinding protections: Enable DNS rebind protection on local DNS resolvers (most consumer and enterprise routers offer this). Consider browser extensions or enterprise policies that block responses resolving to private IP ranges for public domains.

Hardening & Detection

  • Audit chat templates regularly. Establish a known-good baseline for your Ollama model templates and alert on any modification. Template tampering is the persistence mechanism — detect it.
  • Add an authentication layer in front of Ollama regardless of bind address. The API's lack of native auth is an architectural risk that should not be compensated by network controls alone.
  • Monitor Ollama API logs for POST /api/show and template-modifying calls originating from unexpected source IPs or browser user agents.
  • Segment agent tool access. Even if the model is poisoned, limiting the agent's tool permissions reduces blast radius. Apply least privilege to file paths, shell commands, and network egress.

This disclosure is a signal that the security community is catching up to the deployment velocity of local AI tooling. The patterns are familiar — unauthenticated services, permissive network bindings, trust in same-origin assumptions — but the stakes are higher when the compromised service is a decision engine with tool access. Defenders should treat inference servers with the same rigor applied to any privileged API endpoint, not as local utilities safely hidden behind loopback assumptions.