A single visit to an attacker-controlled webpage could give an attacker unauthenticated control of the local model server used by NVIDIA NemoClaw, according to research published by Oasis Security earlier today.
The flaw affects NemoClaw deployments using Ollama for local inference. Oasis found that NemoClaw starts Ollama bound to all network interfaces rather than loopback, which disables Ollama’s host header validation entirely and leaves its CORS check as the only barrier to browser-originated requests.
The researchers then defeated that check with DNS rebinding, a long-established technique for reaching local services from a remote webpage. Because the attacker’s domain resolves first to their own server and then to the victim’s local address, the browser continues to treat the requests as same-origin. The resulting access is unauthenticated and covers the full Ollama API.
“The individual pieces here aren’t new, DNS rebinding’s been a browser party trick for over a decade but pointing it at an unauthenticated local model server is the new part,” Randolph Barr, CISO at Cequence Security, told Expert Insights. “It’s not really in the model; it’s in the plumbing around it.”
Barr’s point tracks with the research itself. The exposure does not depend on a novel attack against the model. It arises from how NemoClaw configures the local inference service and how that service handles browser-originated requests.
Exposure Without a Webpage Visit
The same binding also exposes Ollama to the entire local network segment. Oasis noted that any device on that segment can reach the API directly, with no DNS rebinding and no user interaction at all, including compromised machines, IoT devices or guests on shared networks.
With API access, Oasis documented an attacker being able to run arbitrary inference on the victim’s GPU, enumerate installed models, extract system prompts and templates, delete models, force sign-out from ollama.com and push models to the service under the victim’s account.
Oasis said the most consequential path is poisoning the model’s chat template, the layer that formats every message before it reaches the model. A hidden instruction placed there applies to future conversations, including sessions where the OpenClaw agent supplies its own system prompt, and is invisible to the agent’s client.
Elad Luz, head of research at Oasis Security, told Expert Insights the technique operates below anything an operator can inspect.
“An attacker can alter how NemoClaw’s model reads every message it’s handed, one layer beneath anything a guardrail or an operator can see, and the change survives every future session, leaving an integrity problem that’s very hard to detect,” Luz said.
The Sandbox is not the Boundary
OpenShell’s sandbox does provide filesystem, network and process isolation. But the research notes that agents are typically connected to shared resources such as source control, CI/CD pipelines, internal APIs and cloud services.
“The blast radius of an AI system is its authorizations, not its isolation, and compromising the agent’s behavior hands you everything it was permitted to reach,” Luz said. “The broader trend is that agents are becoming identities with real entitlements, and we’re still securing them like tools.”
Ram Varadarajan, CEO at Acalvio, told Expert Insights that organizations should assume an AI agent inherits the trust and the vulnerabilities of every system it can reach, including the model itself. He pointed to network isolation, least privilege and continuous monitoring as defenses for the broader runtime.
Oasis said it reported the findings to NVIDIA through its Product Security Incident Response Team before publication.
The research does not identify a patched version or offer mitigation guidance, and NVIDIA has not yet published a security bulletin covering the finding. Expert Insights has reached out to the company for clarifications but has not received a response at the time of writing.
