NVIDIA NemoClaw Flaw Lets Malicious Webpage Hijack Local Ollama AI Models

Researchers at Oasis Security have disclosed a serious vulnerability in NVIDIA's NemoClaw reference stack that allows an attacker-controlled webpage to seize control of a local Ollama instance and inject hidden instructions directly into a running AI model. The flaw, reported to NVIDIA's Product Security Incident Response Team (PSIRT) by Oasis Security's head of research Elad Luz, carries no CVE identifier and affects NemoClaw v0.0.35 on macOS and Linux. On Windows and WSL, v0.0.34 shipped a warning instead of a fix, leaving the code path exposed, and no exploitation has been reported as of late August 2026.

At the heart of the issue is how NemoClaw launches Ollama with the environment variable OLLAMA_HOST=0.0.0.0:11434 on the Windows-host path, binding the inference server to every network interface without requiring authentication. The unauthenticated API on port 11434 normally relies on a Host header check and a Cross-Origin Resource Sharing (CORS) layer to reject browser-originated requests. When the bind address is not loopback, the Host header check is bypassed entirely, and CORS treats the request as same-origin because both the Origin and Host headers carry the attacker's domain. An attacker hosting a page on port 11434 can then use DNS rebinding, where a domain first resolves to the attacker's own server and then to 127.0.0.1, while the browser continues to treat the requests as same-origin, to slip past both middleware layers and reach the model server. This kind of misconfiguration is exactly the exposure that a port scanner would surface in seconds, since 11434 should never be reachable outside the loopback interface.

Once inside, the attacker can call the Ollama API to modify the model's chat template, planting hidden system instructions that silently apply to every subsequent conversation. As Oasis Security put it, "Sandboxing protects the endpoint, but taking over the agent takes over its access and tools," meaning a compromised local agent could exfiltrate credentials, pivot to connected services, or quietly steer outputs without the user noticing. NVIDIA's own documentation and Ollama's NemoClaw integration page both currently recommend binding to 0.0.0.0 inside WSL2 or containers, a configuration change that has been previously flagged as the exact step that exposes Ollama instances beyond the local machine. Users running NemoClaw on macOS should confirm they are on v0.0.35 or later, while Windows and WSL users should avoid exposing the daemon until NVIDIA ships a patch.

The chain was validated on macOS using Firefox against a vulnerable NemoClaw instance, and the implications extend beyond a single workstation. Because the poisoned template persists in the local model and applies to every future interaction, detection requires inspecting the model itself rather than monitoring network traffic, and DNS rebinding attacks remain a reliable bypass for browser-based origin controls. Defenders can audit their own exposure with a DNS leak test to verify name resolution behavior, and run a broader privacy checkup to confirm no local services are silently bound to public interfaces.