A significant networking vulnerability in NVIDIA's NemoClaw tool allows attackers to exploit the Ollama API, potentially leading to persistent AI agent corruption through model poisoning.

  • Researchers discovered a network configuration flaw in NVIDIA's NemoClaw tool.
  • Attackers can use DNS rebinding to gain unauthenticated access to local model servers via the Ollama API.
  • The exploit allows for 'model poisoning,' where attackers modify chat templates to inject persistent malicious instructions.
  • While patches exist for MacOS and Linux, Windows users remain vulnerable.

A critical security vulnerability has been identified in NVIDIA's NemoClaw, a tool designed for deploying secure AI agents using the OpenClaw framework. Researchers from Cyera's Oasis Identity Research have revealed that the flaw allows cyberattackers to gain unauthenticated access to local model servers through the Ollama API, paving the way for devastating AI agent corruption.

The vulnerability stems from how NemoClaw configures Ollama within the NVIDIA OpenShell sandboxes. Instead of restricting the API to the local loopback interface (127.0.0.1), the tool configures it to listen on 0.0.0.0:11434. This seemingly minor infrastructure decision exposes the unauthenticated API to the wider network, making it reachable via DNS rebinding—a sophisticated browser-based technique used to target local services from remote web pages.

Read Also:Stone‑Throwing Erupts in Jehanabad Student Protest, Police Intervene

Why This Matters

BozokMedia analysis shows that this vulnerability represents a paradigm shift in AI-related cyber threats. Unlike traditional prompt injection, which is transient and conversation-specific, this exploit targets the LLM's chat template. By modifying this layer, an attacker can inject hidden instructions that persist across all subsequent conversations, making the corruption invisible to both the user and the AI agent itself.

A single visit to an attacker-controlled web page is enough to hand the attacker full, unauthenticated control over the local model server that powers the agent.

The implications for enterprise security are profound. Since AI agents are increasingly granted autonomy to interact with various systems and resources to automate tasks, a compromised agent could effectively serve as a backdoor into an entire organization. Attackers could use the poisoned template to exfiltrate sensitive data, suppress security warnings, or execute unauthorized code.

Historical Background

As organizations rush to integrate 'Agentic AI' into their workflows, the attack surface is expanding rapidly. Historically, cybersecurity focused on protecting static data and software. However, the rise of Large Language Models (LLMs) has introduced 'stochastic' risks, where the very logic and decision-making processes of an application can be manipulated through subtle linguistic or structural changes.

Did You Know?: DNS rebinding works by tricking a web browser into thinking a remote malicious domain is actually a local service running on your own machine.

Frequently Asked Questions

1. How can I protect my systems?
Ensure you are running the latest versions of NemoClaw (v0.0.35 or higher for MacOS/Linux). Windows users should monitor for official patches from NVIDIA.

2. What is the difference between prompt injection and model poisoning?
Prompt injection is a temporary trick used during a single chat, whereas model poisoning involves changing the underlying instructions or templates, making the effect permanent and much harder to detect.