Security researchers at Oasis Security have disclosed a vulnerability in NVIDIA’s NemoClaw AI-agent environment that can allow a malicious webpage to reach the local Ollama server used for model inference and alter how an AI model processes instructions.
The vulnerability, tracked as CVE-2026-65105, was reported to NVIDIA’s Product Security Incident Response Team before the public disclosure, according to reporting on the researchers’ findings.
The issue is significant because the researchers were able to go beyond sending a temporary prompt to an AI system. Their research showed that an attacker could modify an Ollama model’s chat template and place instructions inside it, allowing those instructions to be included in later interactions with the model.
NemoClaw is designed to provide security and privacy controls around OpenClaw AI agents. NVIDIA’s documentation describes OpenShell, the environment used by NemoClaw, as providing controls over processes, filesystem access, network activity and other capabilities available to an agent. The company’s security documentation describes several of those controls.
Oasis researchers found a separate weakness involving the local Ollama inference service. In the configuration examined by the researchers, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, causing the service to listen on all network interfaces rather than only the local loopback interface.
According to the researchers’ findings, the Ollama API does not require conventional authentication. Ollama includes protections intended to restrict unauthorized requests from websites, but the researchers reported that when Ollama is bound to a non-loopback address, its Host-header validation is skipped. That leaves browser-origin protections as a remaining barrier to direct access.
The researchers demonstrated that a malicious website can use DNS rebinding to reach the locally running Ollama service through a victim’s browser. Once access to the API is obtained, an attacker can interact with the model server without needing the user to deliberately open the Ollama service.
The researchers found that the exposed API could be used to enumerate installed models, retrieve model templates and system prompts, obtain information such as the machine hostname, delete models, download or push models, consume GPU resources and force Ollama to sign out. The most consequential finding involved changing a model’s chat template.
A chat template determines how conversations are formatted before they are sent to a model. Oasis researchers reported that they could retrieve a legitimate template, insert an attacker-controlled instruction and write the modified template back to the model.
That approach differs from a conventional prompt injection carried out inside a single conversation. The researchers’ technique changes the model-serving configuration itself, allowing the malicious instruction to be inserted into subsequent requests handled by the model.
According to the technical reporting on the research, this means a simple new conversation or a system prompt supplied by the AI agent does not necessarily remove the altered template. The researchers described the modified template as sitting beneath the normal instruction layer used by the agent.
The potential consequences depend on what the affected AI agent is authorized to do. The research describes possible scenarios in which a compromised model could influence an agent to introduce vulnerable code, conceal security problems, recommend attacker-controlled packages or send information to an external endpoint.
Those outcomes are not automatic consequences of CVE-2026-65105. They depend on the permissions, integrations and resources available to the affected agent. The vulnerability primarily provides a route to modify the model used by the agent; what can happen after that depends on the agent’s existing capabilities.
The research also raises a separate exposure issue because Ollama is configured to listen on 0.0.0.0:11434. Expert Insights reported that systems able to reach that port over a network could potentially communicate with the Ollama API directly, without relying on the browser-based DNS rebinding technique.
That creates two relevant attack paths. An attacker could use a malicious webpage to reach the local service through DNS rebinding, or a device that has network access to the exposed Ollama port could attempt to communicate with the API directly.
The findings do not indicate that an attacker automatically escapes the NemoClaw sandbox. Instead, the research shows that the model service supporting the agent can potentially be manipulated while the agent’s surrounding controls remain in place.
That distinction is important. NemoClaw’s security architecture is intended to restrict what an agent can do on the host system. The Oasis research highlights a different problem: an attacker may attempt to manipulate the model that the agent already relies on, rather than directly defeating the agent’s process, filesystem or network restrictions.
Oasis disclosed the vulnerability to NVIDIA before making the findings public. NVIDIA has continued to publish NemoClaw release updates containing security and runtime changes. Its July 20 release notes, for example, document security-related dependency remediation and changes involving inference-provider configuration, while later releases include additional hardening.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
