NemoClaw Flaw Lets Webpages Poison Local AI Agents

If you’re running NVIDIA NemoClaw with a local Ollama-served model, any webpage your browser visits on the same machine can reach into that local API and corrupt what your AI agent knows. That’s the finding from Oasis Security, who reported the issue to NVIDIA’s Product Security Incident Response team before publishing.

The vulnerability is a networking boundary failure. NemoClaw orchestrates AI agents using Ollama as the local model server. Ollama binds to localhost by default — but NemoClaw’s networking configuration doesn’t enforce the cross-origin restrictions that would prevent a browser-side page from reaching that local endpoint. A malicious webpage, once loaded in any browser tab on the same host, can issue API calls to the Ollama instance, query and modify the model’s context, and inject instructions that persist across agent sessions.

What the attack looks like

The browser’s cross-origin behavior is the delivery mechanism. When you visit a webpage on the machine running your Ollama instance, that page can issue requests to localhost addresses — including the Ollama API port — if the application serving that API doesn’t restrict cross-origin access. NemoClaw’s configuration didn’t do that, and Ollama’s default behavior trusts local requests.

The result: a phishing link, a malvertised redirect, or a compromised page triggers silent, unauthenticated API calls to your local model server. Hidden instructions can be planted — directives that change how the agent interprets future input, exfiltrate conversation history, or embed persistent prompt-injection payloads that survive a context reset.

Oasis Security demonstrated the attack and shared findings with The Hacker News ahead of publication.

What to do

NVIDIA’s PSIRT received the report. A patch is in progress. Until it ships:

• Isolate your dev machine from untrusted browsing. The simplest mitigation is not using the same machine for Ollama agent development and general web browsing. A dedicated VM or separate workstation closes this path without waiting for a software fix.
• Restrict Ollama’s network binding. Bind Ollama to a specific loopback address with explicit firewall rules that block cross-application access from the browser. This raises the bar considerably even though it isn’t a complete fix.
• Watch your agent for behavioral changes. Prompt injection doesn’t announce itself. If an agent starts responding to prompts outside its defined scope, or ignoring constraints it previously respected, treat that as a signal worth investigating.
• Apply NVIDIA’s patch when it arrives. Oasis Security went through coordinated disclosure. A fix should follow — track NVIDIA’s PSIRT advisories.

Pattern in AI tooling

Ollama’s decision to bind to localhost was meant to prevent remote access. That assumption breaks when a browser on the same machine makes cross-origin requests that a poorly configured framework allows. NemoClaw’s gap is the same category of failure seen across AI tooling that moved fast without security hardening.

It’s the same pattern as Langflow’s unauthenticated RCE, MindsDB’s CVSS 10 code execution flaw, and the Ray framework KEV addition — AI infrastructure is being deployed in production at scale well ahead of the security review that enterprise software typically receives.

Sources: The Hacker News, Dark Reading.