A Critical Vulnerability in NVIDIA’s OpenClaw Tool Puts AI Agents at Risk of Persistent Poisoning
Researchers have uncovered a significant flaw in NVIDIA’s OpenClaw tool, which could allow attackers to silently poison large language models (LLMs) used by AI agents. The vulnerability, discovered in NemoClaw and its Ollama API, exposes the local model server to unauthenticated access through browser-based attacks.
The issue lies in how NemoClaw configures Ollama, a popular open-source runtime for running LLMs on local hardware. When OpenShell runs in a container, NemoClaw starts Ollama on an exposed port (11434), making the API accessible beyond the host’s loopback interface. This configuration also disables an Ollama Host-header check designed to prevent browser-based access.
The researchers from Cyera’s Oasis Identity Research demonstrated how attackers can exploit this issue through DNS rebinding, a well-known technique for reaching local services from remote Web pages. An attacker can create a malicious Web page that loads from their own domain and then resolves to the victim’s local machine. The browser will still consider the requests to come from the attacker’s domain, allowing them to interact directly with the local Ollama API without authentication.
Once inside the system, an attacker can modify or delete models, as well as run inference on the poisoned model. However, the most insidious aspect of this exploit is that it allows attackers to silently plant hidden instructions inside the LLM’s chat template. This can persist across conversations and enable the attacker to control the AI agent’s behavior.
The researchers responsibly disclosed the flaw to NVIDIA through its Product Security Incident Response Team (PSIRT). While a CVE tracking number is pending, Oasis confirmed that fixes are available for MacOS and Linux, but not yet for Windows.
Experts warn that this vulnerability highlights the growing concern of “agentic AI risk,” where AI agents can be manipulated or controlled by malicious actors. Randolph Barr, chief information security officer at Cequence Security, notes that “pointing it at an unauthenticated local model server is the new part, and it’s a good preview of where agentic AI risk actually lives.”
As AI adoption continues to grow, this vulnerability serves as a stark reminder of the importance of securing these systems. Organizations using NemoClaw and Ollama should take immediate action to patch their systems and restrict access to sensitive resources.
In practical terms, users should ensure that they are running the latest version of NemoClaw (0.0.35 for MacOS and Linux) and be cautious when interacting with AI agents, especially if they involve untrusted Web pages or DNS rebinding techniques. By staying vigilant and prioritizing security, we can mitigate the risks associated with this vulnerability and protect our AI systems from malicious actors.
Source: Dark Reading — 2026-08-25