A Simple Network Misconfiguration Lets Hackers Quietly Reprogram AI Agents
A flaw in Nvidia's NemoClaw tool means visiting one bad website could hand a stranger permanent control over your AI assistant's instructions, and you'd never know.
Key points
- Researchers at Cyera's Oasis Identity Research found a network misconfiguration in Nvidia NemoClaw, a tool for running AI agents, that lets attackers hijack and silently reprogram the AI.
- The attack uses DNS rebinding, a technique where a malicious website tricks your browser into talking to software running on your own computer, to reach an internal AI service that has no password protection.
- Attackers who succeed can plant hidden instructions inside the AI model that survive across every future conversation, invisible to both the AI and the user.
- A fix exists for macOS and Linux (version 0.0.35); Windows users have no patch yet, though version 0.0.34 includes a warning during installation.
- Nvidia confirmed the vulnerability and published official CVE identifiers for the issues.
Picture a set of sticky notes hidden inside a filing cabinet. Every time an employee pulls a document, they also read the sticky note without realising it. That is roughly what this attack does to an AI agent, except the hidden note can tell the AI to leak data, ignore safety rules, or slip bad code into its answers.
Researchers from Cyera's Oasis Identity Research published their findings this week, first covered by Dark Reading, detailing a flaw in Nvidia NemoClaw, a tool companies use to run the open-source OpenClaw AI agent framework inside controlled software environments called OpenShell sandboxes. OpenClaw is the kind of AI assistant businesses are increasingly connecting to their internal tools, calendars, code repositories, and databases so it can automate work on their behalf.
How does the attack actually work?
The attack reaches your computer through nothing more than a website visit. No download required.
The root cause is a configuration choice. NemoClaw runs a piece of software called Ollama, an open-source program for running AI models on a local computer, on a network address (0.0.0.0:11434) that any software on the machine can reach, rather than locking it to the machine's private loopback address (127.0.0.1), which would keep it strictly internal. Ollama also ships with a safety check that blocks browsers from talking to it directly; NemoClaw's configuration turns that check off.
With those two guards removed, an attacker's website can use a technique called DNS rebinding to reach Ollama. DNS, or Domain Name System, is the internet's phone book, translating website names into numeric addresses. DNS rebinding tricks the browser into believing the attacker's website address actually points to the victim's own computer. The browser, now confused about whose computer it is talking to, happily forwards the attacker's commands to the local Ollama service, which has no password and therefore accepts them without question.
From there, the attacker can read which AI models are installed, run the AI themselves, and, most damagingly, edit the chat template. The chat template is the hidden layer that shapes every message the AI receives, wrapping each conversation in a set of standing instructions before the model ever sees it. Poison the template and you poison every answer the AI gives afterward, permanently, until someone notices and manually resets it.
| Detail | Status |
|---|---|
| Affected software | Nvidia NemoClaw (all platforms before v0.0.35) |
| Fixed: macOS and Linux | Version 0.0.35 |
| Fixed: Windows | No patch yet; v0.0.34 adds an install warning |
| Attack method | DNS rebinding via a malicious webpage |
| Authentication required | None |
| Nvidia public CVEs | Confirmed, published by Nvidia PSIRT |
Should organisations using AI agents be worried?
Yes, though the risk scales with how much access the AI agent has. An agent connected to internal databases, code tools, or email is a far more dangerous target than a standalone chatbot.
"OpenClaw often runs with access to many different systems and resources because it needs that access to automate tasks," said Rickard Carlsson, CEO of AI security firm Detectify. "If an attacker can control the agent's behaviour, that can effectively be like having full access to the machine."
The attack primitives here are not new. Exposed services, unauthenticated APIs (programming interfaces with no password gate), and DNS rebinding are well-documented problems from the early days of web security. What is new is pointing all three at a local AI model server that an automated agent trusts completely. The AI does not question its own instructions. It just follows them.
Cleaning up is also harder than patching a normal software bug. Resetting the poisoned template requires a deliberate step beyond simply installing the updated software.
Nvidia macOS and Linux users running NemoClaw should update to version 0.0.35 immediately. Windows users should check Nvidia's official security page for updates and treat any unexpected AI behaviour as a potential indicator that something is wrong.
Common questions
Do I need to be doing something suspicious online to be affected?
No. Visiting a single ordinary-looking but attacker-controlled webpage is enough to trigger the attack, with no file download and no warning message.
Does this affect the big AI chatbot services like ChatGPT or Gemini?
No. This flaw is specific to organisations running their own AI agents locally using Nvidia NemoClaw. Consumer cloud-based AI services are on separate, remotely managed infrastructure and are not affected by this issue.
