AI AgentsVulnerability ManagementAI Security
NemoClaw is NVIDIA's answer to a reasonable worry. Autonomous coding agents like OpenClaw are useful and alarming in roughly equal measure, so NVIDIA shipped a reference stack — launched at GTC in March — that runs one inside an OpenShell sandbox with restricted filesystem, network and process access. The premise is sound. If the agent goes wrong, the blast radius is a box.
On August 25, Oasis Security published research showing that an attacker never has to touch the box. Elad Luz, the firm's head of research, found that a single visit to a malicious webpage is enough to seize control of the local model server the sandboxed agent talks to — and to leave an instruction inside the model that survives every reset the agent knows how to perform.
The vulnerability is tracked as CVE-2026-65105. No exploitation has been reported. As of writing there is no published CVSS score, which is worth holding onto, because it means this vulnerability currently sorts to the bottom of every queue that ranks by severity number.
NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434.
That is the whole first half. A local inference server, bound to every network interface rather than loopback. Ollama has no authentication — it was never designed to need any, because it was designed to be reached from 127.0.0.1 by the person sitting at the keyboard. What it has instead is an origin allow-list and Host header validation, added in 2024 after CVE-2024-28224, which was itself a DNS rebinding bug. Those checks are skipped when the server is bound to a non-loopback address.
So the second half is a DNS rebinding attack, a browser trick that has been publicly documented for over a decade. The attacker's domain resolves first to their own infrastructure, the victim's browser loads the page, and then the domain re-resolves to 127.0.0.1. The same-origin policy keys on hostname, not on IP address, so the browser considers the follow-up requests same-origin and sends them to the local model server. The origin check that would have caught this is the one that got skipped.
Randolph Barr, CISO at Cequence Security, put the novelty in the right place in SiliconANGLE's coverage: DNS rebinding has been a browser party trick for years, and what is new is pointing it at an unauthenticated local model server.
That is the shape of most AI-stack vulnerabilities right now. Not novel cryptographic breaks or exotic model attacks — old, well-understood web bugs, aimed at a new class of service that got built quickly and inherited none of the assumptions that hardened the last generation.
Access to Ollama's API is bad on its own. The part that makes this research matter is what Luz did with it.
Ollama's /api/create endpoint can modify a model's chat template — the Go template that turns a structured array of messages and roles into the single block of text the model actually processes. It is an implementation detail of the model definition. Change it, and you can append a hidden instruction to every system message, on every conversation, forever, while the model's formatting and outward behaviour stay entirely normal.
Oasis's writeup states the consequence plainly: the client cannot detect or prevent this, because the template is a model-level property invisible to API consumers.
Read that again with your existing controls in mind. Your prompt-injection detector inspects prompts. Your guardrail inspects inputs and outputs. Your logging captures the messages sent and received. None of them can see a chat template, because none of them are looking below the API — and from the API's point of view nothing is wrong. The payload sits, as SiliconANGLE's summary put it, one layer beneath anything a guardrail or an operator can see.
This is the third distinct persistence mechanism in agent stacks we have covered this month, and it is the lowest of the three. The CoSnitch disclosure put the payload in an assistant's memory feature. The mind-virus research put it in the memory files agents write for each other. This one puts it in the model definition. Each iteration moves further from the place anyone is inspecting — and further from anything a user can clear.
Wiping the agent's context does nothing. Restarting the agent does nothing. Clearing memory does nothing. The instruction is not in the conversation; it is in the thing that renders the conversation.
NemoClaw's entire product rationale is containment. It did contain. The agent stayed inside OpenShell the whole time; the attack never attempted to escape it, because it did not need to. It went around the side, took the model backend, and used the agent's own legitimate, sandboxed capabilities against its owner.
Oasis's line is the one to keep: sandboxing protects the endpoint, but taking over the agent takes over its access and its tools.
Those tools are the reason a developer installed the thing. Source control. Cloud credentials. Package registries. CI. An agent with a poisoned template still behaves like your agent, still runs inside its restrictions, still uses exactly the permissions you granted it — it has simply had a standing instruction added that you cannot read.
We made a version of this argument yesterday about seven products that mistook a portability layer for a security boundary. The failure here is different in an instructive way. Those sandboxes were breached. This one held perfectly and was irrelevant, because the boundary was drawn around the wrong asset. The agent was the thing being contained. The model server was the thing with no lock on it.
Every piece of coverage on this ends with "update NemoClaw." That advice is incomplete in a way that deserves more attention than it has had.
According to The Hacker News's reporting of Luz's findings, v0.0.35 fixed the issue on macOS and Linux. On the Windows and WSL path there is no fix: v0.0.34 added a Windows installation that ships a warning instead. The platform breakdown in that reporting is worth reading closely — on non-WSL hosts Ollama binds to 127.0.0.1 behind a token-gated reverse proxy, while on Windows-host and WSL paths it binds to 0.0.0.0 with the proxy not deployed and no authentication in front of it.
So a share of installations — on the operating system with the largest enterprise desktop footprint — have an unauthenticated model control plane that a patch does not currently close.
That converts this from a patching problem into a detection-and-scope problem, which is a different discipline with different tooling. And it lands on an asset class almost nobody governs: developer laptops running their own inference servers. Every engineer who installs a local model stack stands up a network service with no authentication, no inventory entry, no owner of record, and no monitoring. Multiply by headcount. That estate has been accumulating quietly for two years and this is the first bug that makes its shape obvious.
11434 and confirm which interface. 0.0.0.0 on a laptop is the finding; 127.0.0.1 is not. Do this on developer machines and build agents, not just servers.Obiguard does not harden Ollama and does not inspect Go templates. What it addresses is the position this leaves you in — a live exposure, on an asset class you do not inventory, with no fix on one platform and no severity score to justify the work.
That is compensating-control territory, and it runs on telemetry rather than on remediation. Obiguard SOC ingests logs, host metrics and distributed traces over a single OTLP pipeline, with a one-command Kubernetes daemonset for EKS, GKE and AKS and GitHub connected for deployments, pushes and workflow runs. Detection fires from live log volume and rule matches with no detection rules to author first, which is the relevant property when a technique is thirty-six hours old and nobody has written content for it. Every alert carries a full evidence timeline linked back to the raw log events — the artefact that answers "did this agent's credential do anything unusual, and when," which is the only question that actually matters once you accept the template might already be poisoned.
Threat Intelligence is the other half. It cross-matches findings against CISA KEV and FIRST.org EPSS on a schedule, so the moment CVE-2026-65105 moves out of "no exploitation reported" and into the actively-exploited column, that is a change surfaced against your estate rather than a headline you happen to catch. Ranking by KEV and EPSS rather than by CVSS is the difference between a finding with no score sitting at the bottom of a queue and a finding that reorders itself the day it starts being used. Acknowledging or resolving a match is tracked per-match, and dismissing a finding requires a comment recorded to your organisation — so "we decided to accept the Windows path" is a documented decision with a name on it rather than an oversight discovered later.
On the credential side, Governance AI is what bounds the outcome when the instruction is already inside the model. Allow-lists bind each credential to specific model IDs, tools, external domains and invoking identities, so a hijacked agent reaching for an unlisted domain is a denial rather than a detection you hope to make; the Review Queue puts a human in front of out-of-scope actions; and the audit ledger keeps an immutable per-call record of prompt, response, tool calls, model and initiating identity. That is agent governance doing the job guardrails cannot do here — not seeing the poison, but limiting what it can act on.
And the structural question underneath all of it is why there are dozens of unauthenticated inference servers on laptops in the first place. Where the need is people using models rather than agents driving pipelines, Obichat puts that inference in one administered place — SaaS or a private deployment in your own AWS, Azure or GCP tenant, working with any OpenAI-compatible endpoint including self-hosted models, with per-workspace model allow-lists and an exportable activity log. One deployment you configure and monitor is a smaller attack surface than one per engineer that nobody knows exists.
NVIDIA drew a careful boundary around the agent and shipped a genuinely thoughtful containment design. The model server sitting outside that boundary, listening on every interface with no password, was not part of the threat model — because inference servers used to be a thing you ran for yourself, on your own machine, for five minutes. They are infrastructure now, and they are still configured like a hobby. Explore Obiguard SOC or talk to us about what is currently listening on your developer estate.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →