A Single Website Visit Can Poison Your Local AI Agent, Researchers Find

Key points

• CVE-2025-65105, a flaw in Nvidia's NemoClaw AI framework, lets attackers hijack a locally running AI model server by tricking a user's browser into contacting it.
• The attack uses a technique called DNS rebinding, which has existed for over a decade, but pointing it at an unauthenticated local AI server is newly dangerous.
• Once inside, attackers can permanently alter the instructions the AI follows, in a way the AI's own safety tools cannot see or reverse.
• Nvidia patched the vulnerability in NemoClaw version 0.0.35 for macOS and Linux; Windows users remain exposed as of publication.
• Researchers at Cyera, whose findings were first reported by CSO Online, say the underlying risk is that AI agents are being given real system access but secured like simple utilities.

Visiting a website should not let a stranger rewrite the brain of your AI coding assistant. According to new research from security firm Cyera, that is exactly what CVE-2025-65105 (a vulnerability, meaning a software weakness, in Nvidia's NemoClaw AI framework) makes possible.

How does the attack actually work?

The short version: a booby-trapped webpage tricks your browser into sending commands to an AI server running quietly on your own computer, then rewrites the instructions that AI follows permanently.

NemoClaw is a framework developers use to run an AI agent called OpenClaw on their local machine, without sending data to a cloud service. To make the pieces fit together, NemoClaw tells the underlying model server, called Ollama, to listen for connections on every available network channel rather than just the private loopback channel that only the machine itself can reach.

That setting disables a key protection. Ollama normally checks where a request comes from before accepting it. With that check gone, the door is open to DNS rebinding, a trick where a malicious website first pretends to be its own server, then switches its identity to look like your local machine to the browser. The browser is fooled and sends the attacker's commands straight to your Ollama server, no password required.

"DNS rebinding's been a browser party trick for over a decade, but pointing it at an unauthenticated local model server is the new part," said Randolph Barr, Chief Information Security Officer at Cequence Security.

What can an attacker actually do?

The access is alarming in scope. Cyera's researchers found they could list every AI model installed on the machine, read the private instructions the model runs on, delete models, or force the machine to download huge files to eat up disk space.

The deeper problem is what comes next. The researchers injected malicious instructions not into the AI's conversation, where safety filters might catch them, but into its chat template. A chat template is the hidden layer that controls how every message is formatted before the model even reads it. Editing it is like changing the rulebook the AI uses to interpret every future conversation, one level below anything the AI's own safety guardrails can inspect.

The poisoned template does not disappear when the conversation ends. It persists across every future session and does not show up in the model's normal settings view. An agent running under those conditions could be nudged toward dangerous software packages, made to suppress security warnings, or used to leak information it has access to.

"The broader trend is that agents are becoming identities with real entitlements, and we're still securing them like tools," said Elad Luz, head of research at Oasis Security.

Who is affected and what should you do?

If you use NemoClaw on a Mac or Linux machine, update to version 0.0.35 now. Windows users should avoid running NemoClaw while browsing untrusted sites until Nvidia issues a fix. Nvidia did not respond to requests for comment before publication.

For everyone else: if a developer in your organisation uses local AI coding tools, this is worth a conversation with your security team about which ports those tools open and whether they require any form of authentication.