Researchers at Oasis Security have found a way for a malicious webpage to take unauthenticated control of the local Ollama instance serving an NVIDIA NemoClaw agent and plant hidden instructions inside the model itself.
NemoClaw is NVIDIA’s open-source reference stack for running agents such as OpenClaw in its OpenShell sandboxes, with Ollama as a supported local inference backend. On the Windows-host path, NemoClaw starts Ollama bound to 0.0.0.0:11434 with no authentication.
The API relies on two middleware layers to block browser-originated requests. When the bind address is not loopback, the Host header check is skipped entirely, and DNS rebinding makes the CORS layer treat the attacker’s domain as same-origin.
With the API reachable, the report’s payload writes a modified Go template through /api/create. The poisoned template appends attacker-controlled text to every system message at inference time, and the instructions persist across later conversations even when the agent supplies its own system prompt. The client cannot detect or prevent this, Oasis said. The chain was tested on macOS with Firefox against a vulnerable build.
The issue echoes CVE-2024-28224, an Ollama DNS rebinding flaw patched in March 2024 by validating Host headers, a check that is skipped on non-loopback binds.
NemoClaw v0.0.35 fixes the issue on macOS and Linux. No fix exists for the Windows and WSL path, where v0.0.34 ships a warning instead. No exploitation has been reported, and the research carries no CVE.
