Researchers at Cyera have disclosed a critical vulnerability, tracked as CVE-2026-65105, in NVIDIA’s NemoClaw tooling that lets an attacker take over a locally running AI agent with nothing more than getting a victim to visit a booby-trapped webpage — no phishing download, no malicious attachment, just a browser tab. NVIDIA’s Product Security Incident Response Team was notified before the research was made public.

A local server that isn’t really local

The root cause is a configuration choice. When NemoClaw deploys an AI agent inside an OpenShell sandbox environment, it launches Ollama — the local model inference server many developers use to run AI models on their own machines — with the network flag OLLAMA_HOST=0.0.0.0:11434. That setting exposes the inference server on every network interface on the machine rather than restricting it to localhost, and it has a side effect that turns out to be the real problem: it disables Ollama’s Host header validation, a check that browsers normally rely on to prevent exactly this kind of attack.

How a website reaches into your machine

With that safeguard off, the flaw becomes exploitable through a classic technique called DNS rebinding. A malicious site initially resolves to a server the attacker controls. Once the victim has loaded the page and the browser considers it “same-origin” based on hostname, the attacker changes the DNS answer so the same hostname now points to 127.0.0.1 — the victim’s own machine. Because the browser continues to trust the hostname rather than re-checking the IP address, JavaScript running in that tab can now send requests straight to Ollama’s unauthenticated API on port 11434, as if it were talking to the original remote server.

What an attacker can actually do once inside

From there the access is broad. At the low end, an attacker can trigger GPU abuse and fill up disk space by forcing large model downloads, or simply delete models and sign the victim out of local accounts. More concerning is the ability to pull model metadata — names, versions, prompt templates, hostnames, and public keys — which hands an attacker a detailed map of what the agent is running and how it’s configured.

The most serious capability Cyera flagged is model template poisoning. By rewriting a model’s system prompt template, an attacker can inject hidden instructions that persist across every future conversation with that agent, surviving even after the agent has, on the surface, given the user sound security advice. A poisoned agent could be steered to quietly generate vulnerable code, suppress its own warnings, recommend malicious packages, or exfiltrate sensitive data — all while behaving normally from the user’s perspective. That risk is compounded by the fact that AI coding agents are frequently granted standing access to source repositories, CI/CD pipelines, cloud service credentials, internal APIs, communication platforms, and MCP servers, meaning a poisoned agent inherits all of that reach.

What organizations running local AI agents should check

Cyera’s recommendations focus on treating local inference servers as a genuine security boundary rather than an implementation detail:

• Audit whether Ollama or any similar local inference server is bound to 0.0.0.0 instead of 127.0.0.1, and restrict it to loopback-only access unless remote access is explicitly required and authenticated.
• Where port 11434 (or an equivalent inference port) must be reachable beyond the local machine, put authentication and network segmentation in front of it rather than leaving it open.
• Monitor for unexpected changes to model templates and system prompts, since template poisoning is designed to persist quietly.
• Review what standing access AI coding agents hold to repositories, cloud accounts, and internal tools, and scope that access down to what’s actually needed.

As AI agents get wired more deeply into development workflows, the NemoClaw case is a pointed example of how a seemingly minor networking default — exposing a service meant to be local — can turn a single web visit into full agent compromise.