A Critical Vulnerability in NVIDIA’s OpenClaw Tool Puts AI Agents at Risk of Silent Poisoning
Cybersecurity researchers have uncovered a severe flaw in NVIDIA’s NemoClaw tool, which could allow attackers to silently poison large language models (LLMs) used by AI agents. The vulnerability, discovered by Cyera’s Oasis Identity Research, exposes the Ollama API to browser-based attacks that can persistently corrupt AI agents’ instructions.
The issue lies in NemoClaw’s configuration of the Ollama API, which provides local model inference through an HTTP API on port 11434. By exploiting this network exposure, attackers can gain unauthenticated control over the local model server, allowing them to modify or delete models and even plant hidden instructions inside the model itself.
The exploitation process is facilitated by a well-known browser-based technique called DNS rebinding, which enables attackers to reach local services from remote web pages. Once an attacker gains access to the local model server, they can silently poison the model’s chat template, corrupting the AI agents that rely on it for instructions.
This vulnerability puts at risk any organization using NVIDIA’s OpenClaw tool, particularly those in industries such as finance, healthcare, and education, where AI-powered automation is critical. The OpenClaw framework is designed to automate tasks by interacting with various systems and resources, making it a prime target for attackers seeking to exploit this vulnerability.
The discovery of this flaw serves as a stark reminder of the potential risks associated with agentic AI, where autonomous agents can be manipulated or compromised by malicious actors. As Randolph Barr, CISO at Cequence Security, observed, “pointing it at an unauthenticated local model server is the new part, and it’s a good preview of where agentic AI risk actually lives.”
Fortunately, NVIDIA has taken steps to address this issue, with fixes available for MacOS and Linux (v0.0.35). However, users on Windows are still vulnerable until a patch is released.
To mitigate this risk, organizations using NemoClaw should take immediate action by updating their tool to the latest version or restricting access to the Ollama API through proper network configuration. Additionally, AI developers and security professionals must remain vigilant in monitoring for potential attacks and working together to address emerging threats in the field of agentic AI.
As AI-powered automation continues to grow in importance across various industries, it is essential that we prioritize the development of secure and robust AI frameworks that can withstand the evolving threat landscape. The discovery of this vulnerability serves as a wake-up call for organizations to reassess their AI security posture and invest in measures to prevent silent poisoning attacks like this one.
Source: Dark Reading — 2026-08-25