NVIDIA NemoClaw Flaw Lets Malicious Webpage Hijack Local Ollama Models via DNS Rebinding
Oasis Security has disclosed a serious flaw in NVIDIA NemoClaw that lets an attacker take over a local Ollama instance simply by getting the victim to open a webpage. The attack silently implants hidden instructions into the AI model’s chat templates, affecting every future conversation without any visible signs to the user or client application.
The target is NVIDIA NemoClaw, an open-source AI agent reference stack that many teams run locally with Ollama as the inference backend. On Windows, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, exposing the unauthenticated API to all network interfaces. Because the binding is not restricted to 127.0.0.1, Host header validation is bypassed and CORS allows requests from attacker-controlled domains.
The final step uses classic DNS rebinding: the attacker’s domain first resolves to their server and then to 127.0.0.1. The browser believes it is still talking to the same origin, allowing JavaScript on the page to reach the local Ollama API. This technique had already been addressed by Ollama in 2024 under CVE-2024-28224, but NemoClaw’s configuration reopens the exposure.
Once API access is obtained, the attacker does not exfiltrate data. Instead, they abuse the /api/create endpoint to upload a modified Go template that controls how message arrays are rendered. The tampered template appends attacker-chosen instructions after every system message during inference. The poisoned behavior persists across all sessions and even when the agent changes its own system prompt.
Oasis Security emphasized that clients cannot detect or block the change because the template is an internal model-layer property invisible to API callers. The compromise also hands attackers all permissions granted to the agent, including code execution, file access, and internal network reach.
No CVE identifier has been issued and no official fix is available. As of 25 August, no in-the-wild exploitation has been observed. The 10 August v0.0.106 release added a bind probe that refuses to start if Ollama is not bound to loopback, yet the check does not cover the 0.0.0.0 case on Windows and can be disabled with the environment variable NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1.
Security teams running local AI agent stacks are advised to verify that Ollama listens only on 127.0.0.1, avoid exposing port 11434, monitor NVIDIA NemoClaw updates, and implement integrity checks on model files and templates at startup.
Related articles
Detecting Deepfakes: Tools, Signs, and Verification Methods for Video, Photos, and Voice
Deepfake technology now creates highly convincing synthetic videos, photos, and audio that can impersonate real people in video calls or voice messages. The article explains how modern neural networks using GANs, diffusion models, and transformers generate face swaps, voice clones, and fully synthetic scenes. It details visual and audio artifacts that may reveal fakes, such as inconsistent lighting, deformed fingers, or unnatural speech pauses, while noting that these signs are becoming less reliable. Practical verification steps include reverse image searches, metadata analysis, and tools like InVID-WeVerify. Specialized detectors such as DeepFake-o-Meter, Reality Defender, and Sensity AI are reviewed along with their limitations against unknown generators. Real-world cases, including a $25 million corporate fraud using deepfake video calls, illustrate the growing risks and the need for independent confirmation rather than relying solely on automated tools.
Can Open-Source AI Agents Replace Pentesters? Strix and PentAGI Tested on Real 200-Host Perimeter
An independent researcher evaluated two open-source LLM-based pentesting agents, Strix and PentAGI, against a live external perimeter containing roughly 200 active hosts. Both tools autonomously planned tasks, executed CLI utilities, generated proofs of concept, and produced reports while running inside isolated Docker sandboxes. Strix delivered only 15 findings with almost no false positives yet consistently overstated severity, while PentAGI reported 296 vulnerabilities including 42 critical issues, none of which proved exploitable. Real critical vulnerabilities on the same scope, including an RCE chain, were discovered only by a commercial autonomous scanner. The experiment highlighted fundamental limitations in scope control, context management, and risk assessment that still require human oversight. Token consumption reached 145.1 million for Strix and 31.4 million for PentAGI, illustrating the cost of maintaining long-running autonomous operations.
Thousands of Grok-Generated Apps Expose Sensitive Corporate Data Through Default Public Access
Security firm Claroc scanned 43,551 Grok-built application addresses and found 37,571 still online, with 94.7 percent requiring no login. Approximately 650 to 800 of these apps contained sensitive internal data belonging to SpaceX, X, Tesla, and 30 other organizations, including six Fortune 500 companies. Exposed records included ICU patient reports with lab results and ventilator status, contractor timesheets containing plaintext passwords, and Tesla service-center performance evaluations listing employee names, efficiency metrics, and bonuses. Researchers demonstrated that Grok sometimes inverts permission-check logic, allowing unauthorized Google accounts to view and modify data after login. In contrast, ChatGPT-generated apps default to private settings, preventing access even when URLs are discovered via passive DNS. The incident highlights how AI coding tools lower the barrier to publishing internal applications while weakening the review processes that traditionally protected sensitive data.
Enterprise Security Requirements Push Russian Developer to Deploy 125B MoE LLM Locally on Consumer Hardware
A cybersecurity journalist and platform developer detailed his transition from cloud-based AI agents to a fully local 125B-parameter MoE model after enterprise clients raised strict data-exfiltration concerns. The move was driven by the need to keep task statements, source code, configuration files, logs, and regulated personal data inside the corporate perimeter. After testing multiple inference engines, he settled on the Strata engine running a Qwen3.8-Flash-Next model quantized to IQ3_S, achieving 22-25 tokens per second generation and over 500 tokens per second prefill on an RTX 5060 Ti 16 GB GPU paired with a Xeon E5-2640 v3 and 128 GB DDR4. Extensive calibration of expert caching, PCIe fraction, KV streaming, and speculative decoding proved critical to reaching production-grade performance. The resulting setup now handles real agentic workloads such as incident investigation from traces, backlog grooming, and code generation without any data leaving the workstation. The author concludes that hybrid cloud-local workflows will become standard for development teams handling sensitive information within the next one to two years.