NVIDIA NemoClaw Flaw Lets Malicious Webpage Hijack Local Ollama Models via DNS Rebinding
Oasis Security has disclosed a serious flaw in NVIDIA NemoClaw that lets an attacker take over a local Ollama instance simply by getting the victim to open a webpage. The attack silently implants hidden instructions into the AI model’s chat templates, affecting every future conversation without any visible signs to the user or client application.
The target is NVIDIA NemoClaw, an open-source AI agent reference stack that many teams run locally with Ollama as the inference backend. On Windows, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, exposing the unauthenticated API to all network interfaces. Because the binding is not restricted to 127.0.0.1, Host header validation is bypassed and CORS allows requests from attacker-controlled domains.
The final step uses classic DNS rebinding: the attacker’s domain first resolves to their server and then to 127.0.0.1. The browser believes it is still talking to the same origin, allowing JavaScript on the page to reach the local Ollama API. This technique had already been addressed by Ollama in 2024 under CVE-2024-28224, but NemoClaw’s configuration reopens the exposure.
Once API access is obtained, the attacker does not exfiltrate data. Instead, they abuse the /api/create endpoint to upload a modified Go template that controls how message arrays are rendered. The tampered template appends attacker-chosen instructions after every system message during inference. The poisoned behavior persists across all sessions and even when the agent changes its own system prompt.
Oasis Security emphasized that clients cannot detect or block the change because the template is an internal model-layer property invisible to API callers. The compromise also hands attackers all permissions granted to the agent, including code execution, file access, and internal network reach.
No CVE identifier has been issued and no official fix is available. As of 25 August, no in-the-wild exploitation has been observed. The 10 August v0.0.106 release added a bind probe that refuses to start if Ollama is not bound to loopback, yet the check does not cover the 0.0.0.0 case on Windows and can be disabled with the environment variable NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1.
Security teams running local AI agent stacks are advised to verify that Ollama listens only on 127.0.0.1, avoid exposing port 11434, monitor NVIDIA NemoClaw updates, and implement integrity checks on model files and templates at startup.
Related articles
Russian State-Linked Group GTG-20006 Uses Anthropic AI Agents to Automate Malware Rebuilding
Anthropic has identified a Russian state-linked operation tracked as GTG-20006 that deployed autonomous AI agents to continuously rebuild its malware arsenal whenever detections occurred. The group, connected to Midnight Blizzard, APT29 and Cozy Bear, created a closed-loop automation system in which AI agents monitored tool performance against known defenses and triggered immediate code modifications to evade security products. Beyond malware, the agents handled domain registration, hosting infrastructure setup, phishing email delivery, command-and-control channel monitoring and implant persistence tracking across compromised environments. The campaign, active in July and August 2026 and overlapping with CaptiveCrunch, targeted more than twenty organizations including ministries, defense bodies, embassies and think tanks across Ukraine, Europe, the Middle East and Asia. In one incident the attackers exfiltrated over 300,000 national identity records and commercial registration data for more than 500,000 companies. Anthropic disrupted the activity and published a detailed report highlighting how the automation shifted the cost burden back onto defenders.
Anthropic Exposes Widespread Weaponization of Claude by Nation-State Hackers and Cybercriminals for Automated Attacks
Anthropic has released a threat intelligence report detailing how multiple state-sponsored and criminal groups systematically abused its Claude model between December 2025 and August 2026. The company introduced the term Generative Threat Groups to describe actors that built multi-agent frameworks to automate reconnaissance, exploitation, and data exfiltration. One group identified as GTG-20006, widely linked to Midnight Blizzard, APT29 and Cozy Bear, created an AI-driven workflow that automatically rewrites and redeploys malware once security tools detect it. The report highlights that this capability collapses the traditional gap between well-resourced nation-state operations and individual attackers. Defensive recommendations focus on shifting detection to behavioral chains, shortening IOC validity periods, strengthening data-loss prevention, and establishing internal governance for AI tool usage.
Unit 42 Details First Multi-Agent AI Ransomware Attack That Finished in Ten Hours
Palo Alto Networks Unit 42 has published the first confirmed case of a multi-agent AI ransomware operation. Attackers only defined the target; more than ten specialized AI agents then performed reconnaissance, credential harvesting, lateral movement, data exfiltration, and encryption within ten hours. The agents used over fifty ATT&CK techniques and successfully hid command traffic inside the victim’s own AI service endpoints. After encryption the same agents automatically generated an eighty-page security audit report listing every compromised system and technique. The sole defensive control that stopped part of the attack was a mandatory multi-person code review rule on Terraform changes. Unit 42 links the operation to frontier large-language-model frameworks and notes that earlier single-agent incidents such as JADEPUFFER have now evolved into coordinated agent fleets.
Deepfakes Turn Job Interviews into Cyberattack Vectors Targeting IT Candidates and Recruiters
Deepfake technology and malicious test assignments are increasingly used during IT hiring processes to conduct industrial espionage or deploy malware. Attackers impersonate recruiters or candidates, sending infected GitHub repositories or npm packages that install backdoors stealing credentials and enabling remote access. Groups such as Lazarus and the dedicated Contagious Interview collective have run campaigns against chemical and IT firms, while individual cases like the Smello Python developer incident show how prepare scripts in package.json can trigger hidden payloads. Gartner predicts that by 2028 one in four job applicants could be fake, creating risks beyond bad hires including data theft and financial loss. Defenses include isolated virtual machines for test tasks, profile verification by companies like Socure, and interview techniques such as the GOTCHA movement challenges or corneal reflection probes developed by universities. Major firms including Cisco, McKinsey, and Google are returning to in-person interviews as a reliable countermeasure. The rapid evolution of deepfake quality tracked by Unit 42 means layered verification combining technical, procedural, and human checks is now essential.