Can a Webpage Hack Your AI Agent? The NemoClaw Model-Poisoning Attack

Can a webpage hack my AI agent? Yes — under specific conditions. A single visit to an attacker-controlled webpage can give the attacker full, unauthenticated control of the local AI model server behind a developer's agent, and plant hidden instructions that persist across every future conversation.

The Short Answer: Yes, One Webpage Visit Can Take Over Your Agent

On August 25, 2026, researchers at Oasis Security disclosed a vulnerability in NVIDIA NemoClaw, tracked as CVE-2026-65105. Their finding: "A single visit to an attacker-controlled webpage is all it takes to give the attacker these capabilities." [3]

Released at NVIDIA's GTC in March 2026, NemoClaw is NVIDIA's open-source reference stack for running AI agents — specifically OpenClaw — inside OpenShell sandboxes, with local inference handled by Ollama. The pitch was a "safer way" to run agents: the agent is fenced inside a Docker container that limits filesystem, network, and process access. [1] But the sandbox is the wrong layer to defend. NemoClaw's Windows-host configuration launches Ollama bound to every network interface, with authentication disabled, so a malicious webpage can reach the server through the browser via DNS rebinding and — worst case — rewrite the model's chat template to plant hidden instructions that survive every conversation. The attacker "never touches the victim's machine" yet "ends up steering their AI agent from that point forward." [3]

This isn't only a NemoClaw story — it's a clear sign that the model server is an unauthenticated attack surface on your developer's machine, the same class of risk as the prompt-injection backdoor that keeps AI agents off production bug boards. For the wider landscape of agent threats, see our AI agent security risks guide.

What Happened: A NemoClaw Vulnerability in NVIDIA's AI Agent Stack

Oasis researchers Elad Luz and Ofek Itach reported the flaw to NVIDIA's PSIRT before publication, then disclosed the full attack chain with a proof-of-concept video on August 25, 2026. [1][2][3] No active exploitation had been reported as of publication; the proof of concept was demonstrated in Firefox on macOS. [2]

Why this matters beyond the specific product

• Agents carry organizational keys. They typically reach source control, CI/CD, internal APIs, and MCP servers — and, as Oasis puts it, "the blast radius is defined not by the sandbox boundary, but by the scope of organizational resources the agent is authorized to interact with." [3] That footprint is exactly where AI agent safeguards fail in practice.
• The compromise is persistent and invisible. The payload lives in the model definition — "well below the conversation state an operator can reset" — and survives fresh chats; model name, size, and metadata read as normal. [1][3]
• The attack needs no credentials and no foothold on the victim's machine or network — the victim's own browser does the work. [3]

Who Is at Risk: Local AI Agent Risk by Configuration

• NemoClaw users on the Windows/WSL-host path. v0.0.35 fixed macOS/Linux, but there is no fix on Windows/WSL — v0.0.34 added a Windows installation warning instead. [2]
• Anyone running Ollama with OLLAMA_HOST=0.0.0.0:11434. NemoClaw sets it on the affected path, and it is common in hand-rolled WSL2/container setups. When the bind is not loopback, Ollama skips Host-header validation entirely. [1][2][3]
• Businesses whose agents can reach sensitive systems. If an agent can touch source control, CI/CD, internal APIs, or MCP servers, compromising the model behind it is a business compromise.
• Anyone on a shared network. The 0.0.0.0 binding means any device on the same network segment can hit the Ollama API directly — no DNS rebinding needed. [3]

The Model Poisoning Attack Chain: How DNS Rebinding Poisons Ollama

Step 1 — NemoClaw binds Ollama to every interface, on the Windows-host path

Docker containers cannot reach the host's loopback, so NemoClaw launches Ollama with OLLAMA_HOST=0.0.0.0:11434 — port 11434 goes live on every interface, while the install message still reads "Using Ollama on localhost:11434." [1][2][3]

Step 2 — Ollama's defenses are partially disabled

The API on port 11434 has no authentication; a CORS allowlist and Host-header validation stand in for it. When the bind is not loopback, the Host check is skipped entirely, leaving only CORS. [1][2][3]

Step 3 — DNS rebinding walks around CORS

The attacker's domain first resolves to the attacker's server; the victim's browser loads a page the attacker serves on port 11434 — same port as the API, so requests are same-origin. The domain then re-resolves to 127.0.0.1 (or the LAN IP). Same-origin policy keys on the hostname, not the IP behind it, so the browser keeps treating those requests as same-origin — and CORS passes because Origin and Host both carry the attacker's domain. [1][2][3]

Step 4 — Full unauthenticated API access

JavaScript on the page can now call any Ollama endpoint: run inference on the victim's GPU, enumerate models and the machine's hostname and public key, delete models, fill the disk, push models to ollama.com under the victim's account, or force sign-out. [3]

Step 5 — Model poisoning via chat-template injection

System-prompt injection does not survive contact with the agent, because OpenClaw sends its own system prompt that overrides the baked-in one. So the researchers went a layer lower: Ollama's /api/create accepts a template field — a Go template that renders the messages array into the raw text the model reads. The attacker fetches the existing template via /api/show, splices in a hidden instruction, and writes it back via /api/create. Nothing looks wrong. [1][2][3]

Step 6 — Persistent, silent compromise

Every message now passes through the attacker's template, including the agent's own system prompt. It persists across conversations, survives fresh chats, and is invisible: model name, size, and metadata read as normal — "one layer beneath anything a guardrail or an operator can see." [1][2][3]

Step 7 — The agent is steered

A poisoned agent follows the attacker's instructions — backdoored code, suppressed warnings, exfiltrated data, steered recommendations — in every conversation that follows. [1][3]

What an Attacker Can Do With a Poisoned Agent

Direct exploitation (no poisoning needed): GPU theft — arbitrary prompts on the victim's hardware; information disclosure — models, Ollama version, system prompts, hostname, public key; destructive actions — delete models, force sign-out, fill the disk. [3]

Agent compromise via model poisoning:

• Backdoored code that passes casual review. [1][3]
• Suppressed security warnings. [1][3]
• Steered recommendations toward attacker-controlled packages, URLs, and configurations. [3]
• Data exfiltration, if the agent has outbound access. [1][3]

The AI Security Audit: A 10-Point Checklist for Local AI Agents

Audit your local AI agent setup against these 10 checks:

1. Check how Ollama is bound. Run lsof -i :11434 (macOS/Linux) or netstat -an | findstr 11434 (Windows); flag any bind other than 127.0.0.1, especially 0.0.0.0:11434.
2. Audit your NemoClaw version. v0.0.35+ is fixed on macOS/Linux; treat pre-v0.0.35 Windows-host setups as vulnerable.
3. Verify no bypass env var is set. NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE must not be set — it disables the proxy's loopback check.
4. Keep Ollama on loopback behind an authenticated reverse proxy with a Host-header allowlist — the standard fix for this attack class.
5. Block port 11434 inbound at the firewall (LAN and internet) — though this does NOT stop DNS rebinding, since the victim's browser makes the requests.
6. Check chat-template integrity. Run ollama show <model> --template, or read the template field from POST /api/show; compare against a freshly pulled copy or the published Modelfile, and scan for appended instructions.
7. Review what the agent is authorized to reach — source control, CI/CD, internal APIs, MCP servers. Least-privilege it: the blast radius is its authorizations, not its sandbox.
8. Monitor Ollama access. Watch access logs (or a reverse proxy's log) for /api/create, /api/show, /api/tags, /api/me; alert on non-local calls.
9. Test from a second device on your LAN. Confirm the Ollama API is unreachable from another machine.
10. Keep browser and DNS hygiene. Use DNS-rebinding protection where available; treat "visit this link while your agent is running" as risky.

Mitigation: What's Fixed, What Isn't, What to Do Now

Fix status (as of August 25, 2026):

This is the same browser-to-local-service class Ollama hardened in 2024 (CVE-2024-28224) — a reminder that the fix is configuration discipline, not just version bumps. [1][2]

What to do now

• macOS/Linux NemoClaw: upgrade to v0.0.35+ immediately.
• Windows/WSL NemoClaw: assume you are vulnerable until a fix ships — move Ollama to loopback, put an authenticated proxy in front, restrict agent permissions.
• Everyone: NVIDIA's warning not to expose port 11434 only addresses inbound access — DNS rebinding does not need it, since the browser already runs on the host. [2]

The principle, per Black Duck's Collin Hogue-Spears: "Local describes where the model runs. Private describes who can reach it." [1]

And because the payload sits one layer beneath anything a guardrail or an operator can see, add template integrity to your model safety audit checklist as well as your network config.

If you're not sure whether your setup has this exposure — or what your agents are authorized to reach — that is exactly what an AI agent security audit is for. You can also run a quick self-check with our AI audit tool, review the permissions your agents actually hold, and read the related prompt-injection backdoor risk that keeps AI off production bug boards.

Frequently Asked Questions

Bottom Line

This is a clear demonstration that agentic AI risk lives in the plumbing, not the model. A model server bound to every interface, with no authentication, turns one webpage visit into persistent control of an agent that may hold the keys to your source code, CI/CD, and internal systems. The fix is boring and effective: bind to loopback, authenticate the proxy, validate Host and Origin headers, least-privilege the agent, and audit the configuration.

Sources

• SiliconANGLE — "Nvidia NemoClaw flaw let attackers poison the model behind a developer's AI agent" (2026-08-25): siliconangle.com
• The Hacker News — "A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw" (2026-08-25): thehackernews.com
• Cyera / Oasis Security research — "Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning" (2026-08-25): cyera.com
• CVE note: The primary research page and SiliconANGLE use CVE-2026-65105; The Hacker News reported at publication time that the research carried no CVE identifier. This article follows the primary source and SiliconANGLE. [1][3] vs [2]

Accuracy note: All facts, dates, and quotes verified against SiliconANGLE, The Hacker News, and the Cyera/Oasis Security research on 2026-08-25 (source briefing t_68dbe249, accuracy review t_3fec2cc7 including live command tests against Ollama v0.20.6, SEO/AEO spec t_0c33f460). CVE-2026-65105 follows the primary research page and SiliconANGLE; The Hacker News reported no CVE identifier at publication time. No active exploitation reported as of publication; the proof of concept was demonstrated in Firefox on macOS.