A Simple Network Misconfiguration Lets Hackers Quietly Reprogram AI Agents

Key points

• Researchers at Cyera's Oasis Identity Research found a network misconfiguration in Nvidia NemoClaw, a tool for running AI agents, that lets attackers hijack and silently reprogram the AI.
• The attack uses DNS rebinding, where a malicious website tricks your browser into talking to software running on your own computer, to reach an internal AI service that has no password protection.
• Attackers who succeed can plant hidden instructions inside the AI model that survive across every future conversation, invisible to both the AI and the user.
• A fix exists for macOS and Linux (version 0.0.35); Windows users have no patch yet, though version 0.0.34 includes a warning during installation.
• Nvidia confirmed the vulnerability and published official CVE identifiers.

Picture a set of sticky notes hidden inside a filing cabinet. Every time an employee pulls a document, they also read the sticky note without realising it. That's roughly what this attack does to an AI agent, except the hidden note can tell the AI to leak data, bypass safety rules, or slip bad code into its answers.

Researchers from Cyera's Oasis Identity Research published their findings this week, first covered by Dark Reading, detailing a flaw in Nvidia NemoClaw, a tool companies use to run the open-source OpenClaw AI agent framework inside controlled software environments called OpenShell sandboxes. OpenClaw is the kind of AI assistant businesses are increasingly connecting to their internal tools and code repositories so it can automate work on their behalf. We've been tracking OpenClaw's security record since our first story on 11 June 2026; this disclosure is the fourth NemoClaw story we've filed in 90 days, and last week's full security rebuild of OpenClaw makes more sense in this context.

How does the attack actually work?

The attack reaches your computer through nothing more than a website visit. No download required.

The root cause is a configuration choice. NemoClaw runs a piece of software called Ollama, an open-source program for running AI models locally, on a network address (0.0.0.0:11434) that any software on the machine can reach, rather than locking it to the machine's private loopback address (127.0.0.1), which would keep it strictly internal. Ollama also ships with a safety check that blocks browsers from talking to it directly; NemoClaw's configuration turns that check off.

With those two guards removed, an attacker's website can use DNS rebinding to reach Ollama. The Domain Name System is the internet's phone book, translating website names into numeric addresses. Rebinding tricks the browser into believing the attacker's domain actually points to the victim's own machine, so it forwards commands to the local Ollama service. That service has no password and accepts them without question.

From there, the attacker can read which AI models are installed, run the AI themselves, and, most damagingly, edit the chat template. The chat template is the hidden layer that shapes every message the AI receives, wrapping each conversation in standing instructions before the model ever sees it. Poison the template and you poison every answer the AI gives afterward, until someone notices and manually resets it.

Should organisations using AI agents be worried?

Yes, though the risk scales with how much access the AI agent has. An agent connected to internal databases or email is a far more dangerous target than a standalone chatbot.

"OpenClaw often runs with access to many different systems and resources because it needs that access to automate tasks," said Rickard Carlsson, CEO of AI security firm Detectify. "If an attacker can control the agent's behaviour, that can effectively be like having full access to the machine."

The attack primitives here aren't new. Exposed services, unauthenticated APIs (programming interfaces with no password gate) and DNS rebinding are well-documented problems from the early days of web security. What's new is pointing all three at a local AI model server that an automated agent trusts completely. The AI doesn't question its own instructions. It just follows them.

Randolph Barr, CISO at Cequence Security, put it plainly to Dark Reading: "Sandboxing the agent doesn't buy you much if the thing it's built on top of is reachable from any tab in the browser." His preferred fix is treating agent-to-model traffic as its own security layer, watched and controlled independently, rather than adding more guardrails inside the model itself. Companies that wait for the next disclosure to force that conversation will keep being surprised.

Cleaning up is also harder than patching a normal software bug. Resetting the poisoned template requires a deliberate step beyond simply installing updated software.

Nvidia macOS and Linux users running NemoClaw should update to version 0.0.35 immediately. Windows users should check Nvidia's official security page for updates and treat unexpected AI behaviour as a potential indicator that something is wrong.

Common questions

Do I need to be doing something suspicious online to be affected?

No, and that's the uncomfortable part. A single ordinary-looking but attacker-controlled webpage is enough to trigger the attack, with no file download and no warning message.

Does this affect the big AI chatbot services like ChatGPT or Gemini?

This flaw is specific to organisations running their own AI agents locally using Nvidia NemoClaw. Consumer cloud-based AI services run on separate, remotely managed infrastructure and aren't affected.