Nvidia NemoClaw Exposure Enables Local Model Poisoning
Oasis researchers disclosed a NemoClaw vulnerability on August 25 that can give a malicious website access to the local Ollama server behind a developer's AI agent, SiliconANGLE reports. The attack combines NemoClaw's non-loopback Ollama binding, an unauthenticated API and DNS rebinding to reach the victim's local model service. Researchers said the access can enable model deletion, system reconnaissance and model poisoning.
Oasis researchers disclosed a vulnerability in Nvidia NemoClaw on August 25 that can allow a malicious website to reach and control the local Ollama model server used by a developer's AI agent, according to SiliconANGLE. The researchers reported the issue to Nvidia's Product Security Incident Response Team before publishing their findings.
Nvidia introduced NemoClaw at GTC as a runtime for agents such as OpenClaw that uses an OpenShell sandbox to restrict accessible files, networks and processes. SiliconANGLE reports that NemoClaw can run a local model through Ollama rather than a cloud inference service.
How the local server becomes reachable
According to SiliconANGLE's account of the research, Ollama normally binds to 127.0.0.1, but NemoClaw starts it with OLLAMA_HOST=0.0.0.0:11434. That configuration exposes port 11434 on all interfaces, despite an installation message that identifies the service as localhost:11434.
Ollama's API has no authentication, SiliconANGLE reports. The researchers found that its Host-header validation is skipped when the service is bound to a non-loopback address. They then used DNS rebinding to bypass the remaining origin check: a browser first loads attacker-controlled content from a domain, then that domain resolves to 127.0.0.1, allowing requests to reach the victim's local Ollama service under the browser's same-origin rules.
The reported API access can enumerate installed models, retrieve the machine hostname and public key, and delete models. Oasis characterized model poisoning as the most serious outcome. SiliconANGLE reported that the researchers used Ollama's /api/create endpoint and its template field after finding that a hidden system prompt embedded in a model would be overridden by OpenClaw's own system prompt.
Security implications for agent deployments
The vulnerability concerns an important boundary in local-agent architectures: a sandbox can constrain an agent process while a separately exposed local inference endpoint creates a browser-reachable control surface. The Cloud Security Alliance's March draft assessment of NemoClaw similarly described its runtime controls as strongest at deployment and infrastructure layers, while identifying gaps in model security, governance and monitoring.
For teams operating local AI agents, this incident illustrates why localhost assumptions require verification at runtime. Comparable deployments commonly need to review service bind addresses, enforce authentication on local model APIs where feasible, and test browser-mediated paths such as DNS rebinding alongside container and sandbox controls. The reported finding also reinforces that agent security reviews need to cover the model server, browser, network namespace and orchestration layer together, rather than treating the sandbox as the sole trust boundary.
Key Points
- 1Oasis reported that a non-loopback Ollama binding exposed an unauthenticated local model API to browser-mediated DNS rebinding attacks.
- 2The researchers identified model poisoning, model deletion and host reconnaissance as outcomes of control over the local Ollama service.
- 3Comparable local-agent deployments require security review across browser, network, model-server and sandbox boundaries rather than container isolation alone.
Scoring Rationale
The reported issue affects a security boundary central to locally hosted AI agents: the model-serving API behind a sandboxed agent. Its practical impact depends on NemoClaw adoption and vendor remediation, but the exploit pattern is directly relevant to teams deploying Ollama-backed agent runtimes.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
