Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw

Attackers can exploit a security bug in NVIDIA's tool to gain unauthenticated access to the local model server through the Ollama API, paving the way for persistent AI agent corruption.

A vulnerability in NVIDIA's tool for deploying secure AI agents using OpenClaw could allow a cyberattacker to silently poison a large language model's (LLM's) chat template and corrupt the AI agents that are using it.

Researchers from Cyera's Oasis Identity Research discovered the network configuration issue in NVIDIA NemoClaw , and, more specifically, its Ollama API, according to a report published today. The issue can expose the API to browser-based attacks that can allow attackers to persistently poison a model from which an AI agent receives instructions, according to the research.

NemoClaw is a tool used to deploy the open source OpenClaw AI agent framework inside NVIDIA OpenShell sandboxes, while Ollama is a popular open source runtime for running LLMs on local hardware. In NemoClaw, the API provides the tool with local model inference through an HTTP API on port 11434.

The issue that researchers found is that NemoClaw’s configuration of Ollama introduces a network exposure that can allow an attacker , through a malicious Web page and DNS rebinding , to gain unauthenticated control of the local model server. DNS rebinding is a well-known browser-based technique for reaching local services from remote Web pages.

"In short: a single visit to an attacker-controlled Web page is enough to hand the attacker full, unauthenticated control over the local model server that powers the agent," according to the report. "From there, the attacker can silently plant hidden instructions inside the model itself, which the agent then obeys in every subsequent conversation."

Oasis Identity Research responsibly disclosed the flaw to NVIDIA through its Product Security Incident Response Team (PSIRT). NVIDIA did not immediately respond to request for from Dark Reading, but a CVE tracking number is currently pending. Oasis confirmed to Dark Reading that the bug is fixed for MacOS and Linux (v0.0.35); but there's no fix for Windows. However, v0.0.34 includes a Windows installation with a warning.

The flaw itself and how it's exploited aren't necessarily new — an exposed service, an unauthenticated API, and DNS rebinding are all common networking issues, experts say. However, "pointing it at an unauthenticated local model server is the new part, and it's a good preview of where agentic AI risk actually lives," observes Randolph Barr, chief information security officer (CISO) at API security and bot management provider Cequence Security, via email.

The opportunity to exploit begins with how NemoClaw configures Ollama. Because OpenShell runs in a container, NemoClaw starts Ollama on 0.0.0.0:11434 rather than restricting it to 127.0.0.1, making the unauthenticated API reachable beyond the host's loopback interface, according to the researchers. That configuration also disables an Ollama Host-header check designed to prevent browser-based access.

An attacker can exploit this issue through DNS rebinding , the researchers demonstrated in their proof of concept. A malicious Web page initially loads from an attacker-controlled domain, which is then made to resolve to the victim's local machine. Because the browser still considers the requests to come from the attacker's domain, the page can interact directly with the local Ollama API without authentication, according to the report. From here, the attacker can then enumerate models, run inference, and modify or delete models.

Perhaps the most dangerous aspect of the exploit is that it allows an attacker to modify Ollama's chat template — the layer that converts OpenClaw's structured messages, including its system prompt, into the text sent to the model, according to the report.

" OpenClaw often runs with access to many different systems and resources because it needs that access to automate tasks," observes Rickard Carlsson, CEO of AI security firm Detectify. "If an attacker can control the agent's behavior, that can effectively be like having full access to the machine."

Indeed, inserting malicious instructions into that template can supply backdoor-generated code, instruct the model to suppress security concerns, or even exfiltrate data if the agent has outbound access, among other activities, according to the researchers.

Moreover, the attacker can cause those instructions to be appended to the agent's legitimate system prompt at inference time, the researchers noted. This means that, unlike a conventional prompt injection, the poisoned template persists across conversations and is invisible to the agent and user.

Tampering with the agent's instruction in this way also creates a messy remediation path, as organizations "would also need to include resetting those instructions rather than simply patching the underlying vulnerability," Detectify's Carlsson adds.

OpenClaw has already been plagued with a series of security woes since its meteoric rise in popularity among businesses, demonstrating the continued risks associated with moving too quickly to use and deploy AI agents across organizations. The latest issue in NemoClaw demonstrates yet again how a seemingly routine infrastructure decision can cascade into a critical vulnerability when combined with the absence of authentication and browser-based attack techniques, the researchers noted.

To mitigate such issues does require sandboxing the agent; however, this is not a sufficient protection, as it only protects the endpoint, "while the agent's authorized access — to code, tools, APIs, and organizational resources — defines the true blast radius of a compromise," according to the report.

Indeed, " sandboxing the agent doesn't buy you much if the thing it's built on top of is reachable from any tab in the browser," Barr concurs. A better remedy than putting more guardrails inside the model, he says, is "treating agent-to-model and agent-to-API traffic as its own security layer that needs to be watched and controlled," he says.

"Companies bolting agents onto infrastructure that was never built to see this kind of traffic are going to keep getting surprised by findings like this one," Barr warns. "The organizations that get ahead of it are the ones putting a purpose-built gateway in front of their AI traffic now, instead of waiting for the disclosure to force the conversation."

Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician.

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

What Every Enterprise Should Know Securing Cloud Assets In the Age of AI

The Dos and Don'ts of a Cybersecurity Awareness Month People Actually Remember

Building a Secure AI Strategy for the Enterprise

Is your AppSec program Mythos Ready?

Experts Explain How to Develop a Framework for Cyber-Fraud Fusion