Researchers Warn a Booby-Trapped Webpage Could Hijack NVIDIA NemoClaw AI Agents

Key points

• Oasis Security disclosed a weakness in NVIDIA NemoClaw that lets a malicious webpage silently seize control of the local AI engine powering an agent.
• The attack needs no login or password, and can plant hidden instructions inside the AI model itself.
• Oasis Security reported the issue to NVIDIA's Product Security Incident Response Team before going public.
• The finding was shared with The Hacker News ahead of publication.
• Users of local AI agents built on NemoClaw and Ollama should treat the risk as active until NVIDIA issues a fix.

Security researchers at Oasis Security say a flaw in NVIDIA NemoClaw, a framework used to build AI agents that run on a user's own machine, could let a booby-trapped webpage take over the AI engine sitting on that computer. No password. No prompt to the user. Just a visit to the wrong site.

The target underneath is Ollama, a popular tool that runs large language models locally on a laptop or workstation. NemoClaw talks to Ollama to power its agent. Oasis Security says a webpage the victim opens in a normal browser can reach that local Ollama service directly, without any authentication, and issue commands to it.

Worse, the researchers say an attacker can use that access to plant hidden instructions inside the AI model itself. The model then carries those instructions forward into future conversations, even ones the user starts hours or days later.

The finding was shared with The Hacker News before publication. Oasis Security says it reported the issue to NVIDIA's Product Security Incident Response Team, the team inside NVIDIA that handles vulnerability reports.

What is NemoClaw, in plain English?

NemoClaw is NVIDIA software developers use to build AI assistants that run on your own computer instead of in the cloud. Think of it as scaffolding around a local chatbot. It leans on Ollama, a separate program that actually loads and runs the AI model in the background.

When you talk to the agent, NemoClaw passes your message to Ollama, gets a reply, and shows it to you. That plumbing normally sits quietly on your machine and only listens to programs on the same computer.

How does the attack work?

A malicious webpage, loaded in the victim's own browser, contacts the local Ollama service and issues commands as if it were a trusted local program. Oasis Security describes the service as reachable without authentication, meaning no login step stands in the way.

Once inside, an attacker can push instructions that get baked into the local model. The researchers frame this as poisoning the model: the AI will keep obeying the hidden guidance long after the malicious tab is closed.

For an ordinary user, that could mean an AI assistant that starts steering answers, leaking data typed into it, or nudging the user toward risky actions, without any visible sign that something changed.

Should users of local AI tools be worried?

If you run a local AI agent built on NemoClaw and Ollama, treat the risk as live until NVIDIA publishes a fix or mitigation. Oasis Security says it went through NVIDIA's PSIRT process, so a formal advisory and CVE identifier are the next things to watch for.

For everyone else, the wider lesson lands cleanly. Local AI tools feel private because the model sits on your own hardware. But if the service that runs the model listens on your machine without a password, any webpage your browser opens can potentially talk to it too.

A few sensible steps while a patch is pending:

• Avoid running local AI services on machines you use for general web browsing.
• Keep NemoClaw, Ollama and your browser updated the moment fixes land.
• If you must run both on the same machine, restrict which programs can reach the local Ollama port using your operating system's firewall.
• Be sceptical of odd behaviour from your local AI assistant, especially sudden changes in tone, refusals, or unsolicited advice.