A vulnerability in NVIDIA’s NemoClaw, the deployment wrapper for the OpenClaw AI agent ecosystem, demonstrates how configuration choices in agent infrastructure can create attack surfaces that bypass traditional security controls entirely. Research published August 25 by Cyera details CVE-2026-65105 — a flaw that lets an attacker hijack a local AI agent with a single website visit.
The root cause is a deployment decision, not a model flaw. To let the OpenShell sandbox container reach the Ollama inference backend, NemoClaw binds Ollama to 0.0.0.0:11434. That single configuration disables Ollama’s built-in Host header validation and exposes the API to the entire local network — no authentication required.
The Attack Chain #
The exploit is precise. When a victim visits an attacker-controlled webpage while NemoClaw is running locally, the attacker uses DNS rebinding to bypass the browser’s same-origin policy. The browser ties security to the hostname, not the resolved IP. The attacker’s domain initially resolves to a remote server, then rebinds to 127.0.0.1.
Because the Origin and Host headers both reflect the attacker’s domain, Ollama’s CORS middleware treats the request as same-origin. With no authentication on port 11434, the attacker gains full API access — the ability to enumerate installed models, pull or push arbitrary models, and delete existing ones.
The LAN exposure is equally straightforward. Any device on the same network segment can hit the Ollama API directly, no DNS rebinding required. The 0.0.0.0 binding turns every NemoClaw instance into an open local endpoint.
Model-Template Poisoning: A Structural Attack #
The most consequential aspect of CVE-2026-65105 is the novel attack class it enables. Using the /api/create
endpoint, an attacker fetches a model’s existing template via /api/show
, injects malicious instructions into the Go text/template that controls how messages are rendered before inference, and re-uploads the poisoned version.
This is not prompt injection. Prompt injection operates on a per-query basis — it affects a single conversation. Model-template poisoning is structural. The template sits between the client’s messages and the inference engine, appending attacker-controlled instructions to every system message render path. As Elad Luz, head of research at Oasis Security (now part of Cyera), noted, the poisoned template “sits one layer below guardrails and operator visibility.”
The persistence is the key distinction. The poisoned template survives reboots, model reloads, and conversation resets. It is not a transient manipulation — it is a permanent modification to how the agent processes every future interaction. The downstream damage depends on what the agent can access: source control repositories, cloud credentials, database connections. The attacker’s instructions ride along with every inference call, invisible to monitoring tools that operate at the prompt or output layer.
The Agent Infrastructure Wave #
CVE-2026-65105 is not an isolated disclosure. It extends the pattern documented across the MCP supply chain wave — the OX Security advisory cataloging 10+ CVEs in Anthropic’s MCP SDK, the OpenClaw CVE-2026-25253 one-click RCE, and the growing catalog of agent-native infrastructure flaws. The common thread is that the deployment and orchestration layer — not the model, not the agent framework — is where the most exploitable gaps live.
NemoClaw’s 0.0.0.0 binding exists because container networking requires it. The Ollama API lacks authentication because it was designed for local use. These are reasonable engineering decisions in isolation. Together, they create an attack surface that a single webpage visit can reach.
What Operators Should Do #
Organizations running local AI agent infrastructure should audit their Ollama and inference backend configurations immediately. Binding to 127.0.0.1 instead of 0.0.0.0 eliminates the LAN exposure and makes DNS rebinding the only viable attack vector. Adding authentication to the local API — even a simple token — closes the unauthenticated access path entirely.
For security teams tracking the agent infrastructure wave, the lesson is consistent: the deployment wrapper is a critical security boundary. Every configuration choice that prioritizes convenience over isolation is a potential entry point. The model is not the attack surface. The plumbing around it is.