NemoClaw Vulnerability Exposes Local AI Models to Persistent Template Poisoning

Security researchers at Oasis Security have identified a critical vulnerability, tracked as CVE-2026-65105, that enables the permanent modification of local AI model behavior through a single malicious webpage visit. This exploit targets the NemoClaw framework, specifically affecting Windows-based deployments where the Ollama inference engine is configured to bind to all network interfaces.

The vulnerability functions by chaining three distinct security failures: an overly permissive network binding, a bypassed authentication layer, and an exposed model customization endpoint. By setting the OLLAMA_HOST environment variable to 0.0.0.0, the framework inadvertently disables essential Host header validation, rendering the Ollama daemon reachable from any browser process on the host machine.

Attackers leverage DNS rebinding to circumvent the browser’s same-origin policy, effectively tricking the local environment into treating an external request as a trusted internal command. Once access to the API is established, the payload targets the /api/create endpoint to overwrite the model’s chat template. This template, written in Go, governs how structured input is serialized into raw text before inference, meaning the injected instructions persist across all subsequent interactions.

The Go-based serialization process is particularly susceptible because it operates as a low-level instruction set for the model’s input formatting. By manipulating this layer, an attacker ensures that every message—regardless of the user’s intent—is wrapped in malicious directives that the model interprets as foundational system instructions. This mechanism bypasses traditional prompt-injection defenses because the client application remains unaware that the underlying template has been altered at the model-metadata level.

DNS rebinding facilitates this by forcing the browser to resolve a domain to 127.0.0.1 after the initial connection is established, allowing the attacker to bypass CORS restrictions. Because the browser perceives the request as originating from the same source, it permits the HTTP call to the local Ollama API. This technique effectively bridges the gap between the public internet and the developer’s private, local inference environment.

The persistence of this attack stems from the fact that the chat template resides one layer beneath the application’s visibility, effectively operating at the model-metadata level. Because the modification occurs within the model’s own configuration state, standard endpoint detection and response tools fail to register the change. No new files are written to the disk, and no anomalous processes are spawned, leaving the security posture of the host machine appearing entirely nominal.

Elad Luz, head of research at Oasis Security, confirmed the feasibility of this attack chain through demonstrations on macOS environments using Firefox. The research highlights a fundamental disconnect in current security models, which often conflate the physical location of a model with its logical accessibility. As noted by Collin Hogue-Spears, senior director of solution management at Black Duck Software, the assumption that local execution equates to private execution remains a significant blind spot for developers.

The technical implications of CVE-2026-65105 extend beyond simple prompt injection, as the poisoned template survives system reboots and remains active regardless of the system prompts provided by the client application. Organizations relying on local inference stacks must now account for the risk posed by browser-based vectors that exploit the underlying network configuration of their AI infrastructure. The lack of visibility into model-level metadata changes suggests that current security operations centers are ill-equipped to detect this specific class of compromise.

NVIDIA has addressed the vulnerability in NemoClaw version 0.0.35 for macOS and Linux, yet the Windows-host deployment path remains exposed as of August 25, 2026. The existence of an override flag, NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE, allows for the potential bypass of even these limited protections, leaving developers vulnerable if they rely on default configurations. Future mitigation strategies will likely require a shift toward stricter interface binding and the implementation of robust, model-level integrity checks that go beyond standard file-system monitoring.

Stakeholders should prioritize the migration of Ollama instances to local loopback addresses and monitor for any unauthorized modifications to model metadata files. As the adoption of local AI agents grows, the security of the inference backend will become a primary concern for enterprise governance.