- The Mess: CVE-2026-65105 lets an attacker reach the unauthenticated Ollama inference service used by NVIDIA NemoClaw through a DNS-rebinding attack. Researchers showed that a single malicious webpage could permanently alter the model’s behavior.
- The Damage: The attacker can poison the model’s chat template so malicious instructions survive future conversations, potentially steering an AI agent toward systems and data it can legitimately access.
- The Fix: Update NemoClaw immediately. NVIDIA lists 0.0.25 as the fixed version for CVE-2026-65105 on Linux.
Your AI agent doesn’t need malware to get compromised.
It may only need you to open the wrong website.
That’s the ugly part of CVE-2026-65105.
The Local AI Server Wasn’t Really Local
NemoClaw uses Ollama as its local inference server.
The vulnerable setup exposed the Ollama API without authentication.
NVIDIA officially rates the flaw CVSS 8.1 — High and describes it as missing authentication on the inference service. Affected Linux versions are NemoClaw 0 through 0.0.25, with the security update addressing the issue.
The interesting part isn’t simply that the API was reachable.
It’s how an attacker reaches it.
The Browser Becomes the Attack Path
Researchers from Oasis Security demonstrated a DNS rebinding attack.
The victim visits an attacker-controlled webpage.
The browser initially communicates with the attacker’s infrastructure.
Then DNS resolution changes.
The browser can be tricked into making requests toward services running on the victim’s own machine.
That includes the locally running Ollama API.
No malware installation is required.
No direct inbound connection from the Internet is required.
The browser does the work.
The Model Can Be Permanently Poisoned
This is where the vulnerability becomes much more interesting than a normal localhost exposure.
The researchers demonstrated access to Ollama’s model-management functionality and used it to modify the model’s chat template.
That template controls how conversations are assembled before the model processes them.
Inject instructions there and they can become part of future interactions.
The malicious instructions don’t have to appear as an obvious user prompt.
They sit underneath the conversation.
And they can survive later sessions.
The User May See Nothing
That’s the dangerous part.
The AI agent can continue responding normally.
There doesn’t need to be a suspicious popup.
No ransomware screen.
No strange executable.
No obvious malware process.
The model itself has been modified.
From the user’s perspective, the assistant may simply start behaving differently.
But the attacker can potentially influence what the agent does with its legitimate permissions.
If the agent can access files, APIs, repositories or cloud services, the impact can extend beyond the model.
Sandboxing Doesn’t Automatically Save You
NemoClaw was designed around stronger isolation for AI agents.
But the attack targets the model server underneath the agent.
That’s an important architectural distinction.
You can sandbox the agent.
You can restrict its filesystem.
You can control its processes.
But if an attacker can modify the model configuration the agent trusts, the attacker has gained influence over the decision-making layer.
The sandbox still exists.
The poisoned model simply operates inside it.
NVIDIA Has Patched It
NVIDIA released a security update for NemoClaw and OpenShell on August 28.
For CVE-2026-65105, NVIDIA lists NemoClaw Linux versions 0 through 0.0.25 as affected and 0.0.25 as the updated version.
The same bulletin covers a much larger collection of NemoClaw and OpenShell vulnerabilities.
Several carry CVSS 9.9 Critical ratings, including OpenShell sandbox-escape issues.
So updating isn’t just about one CVE.
The entire stack needs attention.
Check the Model Too
If a NemoClaw installation was exposed while vulnerable, updating the software shouldn’t be the end of the investigation.
The model configuration should also be checked for unexpected changes.
A persistent poisoning attack is different from ordinary malware.
Deleting a suspicious executable won’t necessarily undo a modified model template.
The malicious state can live inside the AI infrastructure itself.
No Active Exploitation Confirmed
There is currently no confirmed active exploitation associated with CVE-2026-65105 in the official vulnerability record.
CISA’s vulnerability enrichment currently assesses exploitation as none.
But researchers have already demonstrated the attack chain.
That’s enough reason to patch.
A working browser-to-localhost attack against an AI agent is not something defenders should wait to see weaponized.
Bugstoday Opinion
The phrase “local AI” creates a dangerous illusion.
Local doesn’t mean unreachable.
Private doesn’t mean authenticated.
And an AI agent isn’t isolated just because its model is running on your own machine.
CVE-2026-65105 turns a normal website visit into a potential path toward persistent model poisoning.
The attacker doesn’t need your password.
They don’t need malware.
They don’t even need to connect directly to the machine.
Your browser can connect to it for them.
Bugstoday verdict: the next AI attack may not target the model through a prompt. It may target the infrastructure underneath it through your browser. Patch NemoClaw — and stop assuming that localhost means trusted.
Today’s Bugs. Tomorrow’s Breaches.
