One Web Page Poisons Your Local Model: Why NemoClaw Could Not Fix the WSL Path

Oasis Security disclosed CVE-2026-65105 in NVIDIA NemoClaw on August 25, 2026. Open one attacker-built web page and that page reaches the model server running on your laptop with no authentication, then rewrites how the model assembles a conversation in the first place. Close the page and the changed configuration stays.

NemoClaw is NVIDIA's open-source tool for running agents like OpenClaw inside an isolated box so they cannot reach your personal files or cloud accounts. The repository describes itself as running supported agents "more securely inside NVIDIA OpenShell," and it has passed 22,000 GitHub stars. The box held again this time. What opened was the model server standing outside it.

How a web page rewrites your model configuration

NemoClaw starts the local inference server Ollama with OLLAMA_HOST=0.0.0.0:11434. That is not an address reachable only from inside your machine; it opens a door on every network interface. And the Ollama API has no login step of its own.

The chain runs like this.

DNS rebinding is an old technique: the attacker's domain resolves first to their own server, then moments later to 127.0.0.1. Browsers decide same-origin by hostname rather than by IP, so the requests keep being allowed even after they point at your own machine. Ollama does carry a Host header check, added in March 2024 for CVE-2024-28224, but that check is skipped when the server is bound to a non-loopback address.

Up to this point it is an ordinary local-service exposure. What differs is what the attacker changes. Text pushed into a system prompt gets overwritten by the agent's own instructions. So the attacker goes one layer below, to the chat template. The template is the frame that assembles user and system messages into the actual input string for the model, and it is applied after the agent submits its instructions. A poisoned template appends the attacker's sentence to the end of every system message at inference time.

Elad Luz, head of research at Oasis Security, told SiliconANGLE that "the poisoning happens one layer below what guardrails or operators can see." The template is not exposed to whatever calls the API. Neither the agent nor the audit log knows the prompt it received was altered.

The goal matches the attack that plants fabricated facts in an agent's memory through a single email. The difference is where it lands: in the model files rather than in memory, so clearing the conversation does not remove it.

What NVIDIA fixed and what it did not

NemoClaw's defense has five layers: network, filesystem, process, gateway authentication, and inference. In the official documentation diagram, the inference layer is defined as controlling "which AI models the agent can use." It looks at which model is in play, not at which template that model uses internally.

The repair history is in the repository.

There is a place this defense does not reach. NVIDIA wrote out, in the body of issue #6014, a table of which of the three run topologies gets the auth proxy in front of Ollama.

The sentence under the table names the remaining hole. The Windows host launcher binds Ollama directly to 0.0.0.0:11434 so that Docker Desktop's WSL virtual machine can reach it, and the only mitigations on this path are the Windows Defender firewall and a warning on standard error. The issue body states that the Docker Desktop topology is "explicitly out of scope."

WSL is not a fringe environment here. It is one of the four platforms NemoClaw's official prerequisites document lists as supported, and the README tells users to install with default settings on a DGX or WSL host. Open src/lib/inference/ollama/windows.ts in the repository and you find OLLAMA_HOST=0.0.0.0:11434 written as a persistent user-scope environment variable. The comment says this is deliberate, so the binding survives into the next login when Ollama starts from the tray. Turn NemoClaw off and that account's Ollama stays open.

The defense that shipped in v0.0.106 has gaps of its own. These are limits the repository's SECURITY.md documents about itself.

NVIDIA also edited its security documentation the same day. Commit #10035 removed "(default)" from the label "Locked-Down (default)." The onboarding default is the Balanced tier, which automatically enables the npm, pypi, huggingface, and brew presets. Getting the most locked-down state means choosing the Restricted tier during onboarding yourself and turning web search off as well.

What you can use today

If you use NIM, the vLLM or llama.cpp instances NemoClaw manages, or a remote provider, your traffic never passes through this proxy and this vulnerability does not apply. As of August 25, 2026, no exploitation in the wild has been reported. CVE-2026-65105 sits in the US National Vulnerability Database (NVD) as reserved only, so it carries no CVSS score yet. Unlike the Ray vulnerability CISA put on a three-day clock, this one comes with no mandated remediation deadline.

Bumping the version is not the end of it. The first thing to check is whether the model you are running is already poisoned. If you use Ollama, print the template with the command below and look at it; if a sentence appears at the end that was not in the model card, delete that model and pull it again.

ollama show --template nemotron-3-nano:30b

If you are running on WSL or Windows, also check [Environment]::GetEnvironmentVariable('OLLAMA_HOST','User') in PowerShell. If it returns 0.0.0.0:11434, that value is sitting in your account whether or not NemoClaw is running, and there is no patch to apply on this path yet. The time to revisit this configuration is when issue #6014 closes and a Windows-specific mitigation ships in its own release.