Explore the vulnerabilities in NVIDIA's NemoClaw and how they impact the security of AI agents.
NVIDIA's NemoClaw has recently come under scrutiny due to a significant security vulnerability that allows for severe potential attacks on local AI agents. The research, published on August 25 by Cyera, details CVE-2026-65105—an issue that could expose AI systems to drive-by hijacking and persistent model poisoning. In today’s increasingly complex AI landscape, understanding these ecosystem/">vulnerabilities is crucial.
At the heart of CVE-2026-65105 lies a flawed configuration choice during deployment. It involves binding Ollama, the inference backend, to 0.0.0.0:11434. This configuration decision disables essential security measures, specifically Ollama's built-in Host header validation.
When an individual running NemoClaw visits a maliciously controlled webpage, the attacker exploits DNS rebinding techniques to bypass the browser’s same-origin policy. Typically, web browsers ensure that requests are only made to the same domain to prevent cross-origin attacks. However, in this case, the attacker's domain initially resolves to a remote server but then rebinds to the local IP address (127.0.0.1).
Since the Origin and Host headers align with the attacker’s domain, Ollama’s CORS (Cross-Origin Resource Sharing) middleware incorrectly interprets the request as safe. This lack of authentication on port 11434 grants the attacker unfettered access to the API, including the ability to manage models stored within the system. This exposure not only allows for data manipulation but also presents significant security risks to local networks.
Perhaps the most alarming implication of CVE-2026-65105 is the introduction of a novel attack vector: model-template poisoning. This approach differs drastically from traditional prompt injection. While prompt injection affects only a single interaction, model-template poisoning performs structural alterations that impact every future interaction of the AI agent.
The attacker can leverage the /api/create endpoint to obtain existing model templates via /api/show, inject harmful commands, and then re-upload the tainted version of the template. This means any interaction with the AI potentially executes the attacker's malicious instructions. The poisoned templates persist through reboots and model reloads, continually modifying the agent's processing of user input.
This level of persistence poses profound risks, especially for organizations dependent on AI agents with access to sensitive systems, including source control, cloud services, and databases. As Elad Luz from Oasis Security pointed out, poisoned templates operate stealthily, often escaping the notice of monitoring tools designed to observe outputs rather than the structures affecting them.
CVE-2026-65105 reveals a broader trend in the security of AI deployment and orchestration models. It is not an isolated event; numerous vulnerabilities have been documented across various platforms that utilize similar configurations. For instance, the pattern noted in OX Security reports includes multiple CVEs affecting Anthropic’s MCP SDK and the OpenClaw framework.
The critical takeaway from these findings is that the most exploitable security gaps exist not just within the AI models or the agents themselves, but in the infrastructure supporting them. In particular, the deployment layer comprises numerous potential entry points if configurations prioritize accessibility over security.
Organizations operating AI agent infrastructure have a responsibility to evaluate their configuration settings critically. A key recommendation is to bind Ollama to 127.0.0.1 instead of 0.0.0.0, which can mitigate the exposure to local area network attacks. This change renders DNS rebinding attacks ineffective by limiting API access strictly to local connections.
Moreover, adding a layer of authentication to the local API—such as introducing a simple access token—can entirely close off unauthorized access. For security professionals monitoring the evolution of AI technologies, it’s imperative to recognize that deployment choices can indeed shape the security landscape, often more than the technologies themselves.
Prioritize continuous auditing of configurations and a thorough understanding of the implications of each choice, as these can heavily influence the resilience of AI systems against evolving threats.
The vulnerabilities highlighted by the NemoClaw issue underline the complexity of ensuring security in AI systems. As organizations increasingly rely on AI for critical functions, the stakes for maintaining secure configurations are higher than ever. The incident reaffirms the necessity for a proactive stance on security, highlighting the importance of understanding the interplay between AI technologies and their deployment infrastructures.
As cybersecurity threats evolve, organizations must stay ahead by investing in better security practices and continuing education for their teams about current vulnerabilities. The road forward will demand a holistic approach to AI security, integrating robust authentication, consistent auditing, and a culture of prioritization for security in deployment decisions.
NemoClaw is a deployment wrapper designed for NVIDIA's OpenClaw AI agent ecosystem that facilitates the management of local AI agents.
This vulnerability allows an attacker to hijack a local AI agent through a single malicious webpage visit by exploiting DNS rebinding and excessive local network exposure.
Organizations should audit their configurations, bind APIs to local addresses, and add authentication mechanisms to local APIs to enhance their security against potential threats.