Nvidia NemoClaw vulnerability allows full control of AI agent’s local model server

Researchers at Oasis Security have disclosed a vulnerability in Nvidia Corp.’s NemoClaw, a tool designed to enhance AI agents. This flaw grants attackers complete control over the local model server powering a developer's AI agent, based on information published by Silicon Angle.

The vulnerability, identified as CVE-2026-65105, can be exploited by visiting a malicious website. It allows an attacker to gain full control of the Ollama server, which NemoClaw uses to run AI models locally. The exploit bypasses security measures by leveraging DNS rebinding to circumvent origin checks and accessing Ollama's unauthenticated API. Attackers can then enumerate installed models, steal sensitive information like the machine's public key, or poison models by injecting hidden system prompts. This poisoning allows malicious instructions to be appended to every message sent by the agent, potentially causing it to write insecure code or exfiltrate conversation data.

Experts note that the vulnerability lies in the "plumbing" around the AI model rather than the model itself, highlighting risks in how these components are interconnected and exposed. While Ollama has previously addressed similar exposures, the current design of NemoClaw, when configured improperly, remains susceptible.

Source: Silicon Angle