A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA Nemo Claw
Summary: Oasis Security disclosed a weakness in NVIDIA NemoClaw that lets an attacker-controlled webpage take unauthenticated control of the local Ollama instance behind an AI agent and plant hidden instructions in the model's chat template. NemoClaw v0.0.35 fixed the issue on macOS and Linux, but no fix exists on the Windows and WSL path, where v0.0.34 added a Windows installation carrying a warning instead; no CVE was assigned and no exploitation had been reported as of August 25, 2026.
What's compelling: The poisoned template appends attacker text to every system message at inference time and survives the agent supplying its own system prompt, and Oasis Security states the client cannot detect or prevent it because the template is a model-level property invisible to API consumers. The v0.0.106 loopback check that would block this does not run on the WSL and Windows-host paths where NemoClaw sets OLLAMA_HOST=0.0.0.0:11434, and the repository contains no chat-template integrity check.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2024-28224
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026