The IT security provider Oasis Security has disclosed a vulnerability in Nvidia’s AI agent software NemoClaw, which allows a single visit to a malicious website to take over a locally running AI agent. The flaw exploits a misconfiguration of the connection to the language model tool Ollama; a patch is already available for macOS and Linux, while Windows and WSL currently only have a warning.
Misconfiguration exposes the Ollama interface externally
NemoClaw is Nvidia’s open-source reference stack that allows the AI agent OpenClaw to be permanently operated locally; the tool was introduced in March 2026 at the developer conference GTC. It integrates the language model tool Ollama by default and starts it with the setting OLLAMA_HOST at 0.0.0.0:11434 instead of exclusively on the local loopback address. As a result, the programming interface, which is actually intended only for the local machine, is accessible via any network interface.
Ollama normally blocks unauthorized access since a security vulnerability discovered by the NCC Group in 2024 through a check of the so-called Host header. However, according to Oasis Security, this protective function does not apply when the service is not exclusively bound to localhost – exactly the state that NemoClaw creates through its default setting.
Nvidia offers NemoClaw for free as open-source software for developers who want to run an AI agent on their own machine instead of in the cloud. It can be obtained through the public GitHub repository; no registration or subscription is required.
Attackers inject persistent commands via a browser technique
To bypass the remaining browser protection layer, attackers, according to researchers from Oasis Security, now part of the security provider Cyera, use a technique known as DNS rebinding: A malicious domain initially resolves to a foreign server but then quickly switches to the address 127.0.0.1. The browser treats both requests as the same origin.
This allows JavaScript code on the visited page to connect directly to the local Ollama interface – completely without credentials or another click from the user. Through the endpoint /api/create, the attack code then modifies the chat template of the model and embeds hidden instructions within it.
Since this template exists at the model level, it survives every new system prompt: The model receives both the actual instruction of the AI agent and the injected instruction from the attacker in every subsequent conversation. Affected systems potentially expose access to source code management, cloud accounts, and other tools used by the AI agent.
Patch only closes the gap on two operating systems
Oasis Security reported the finding to Nvidia’s security team PSIRT before publication, as reported by The Hacker News. With version 0.0.35, Nvidia has since corrected the binding to 0.0.0.0 for macOS and Linux; a complete fix is still missing for Windows and the Windows Subsystem for Linux (WSL).
Version 0.0.34 only added a warning during installation for the two systems. Those running NemoClaw on Windows or WSL remain vulnerable until Nvidia provides a complete patch.
This is not the first case of this kind: Just last summer, a similarly open network interface on the open-source platform Ruflo allowed attackers to take over foreign AI agents and steal access keys. A recent report from the security provider Netskope also notes a significant increase in data leaks caused by AI agents in companies. The frequency suggests that standard configurations of agent-capable tools are still too rarely checked for unauthorized network access.
The case shifts the focus on AI security from the model level to the network configuration of the surrounding tools: It is not the language model itself that fails here, but a default setting in the software that embeds it. It will be crucial whether Nvidia closes the Windows and WSL gap before the technology is exploited on a larger scale – until then, the only solution is to not leave port 11434 exposed to the internet.
