A network configuration flaw in NVIDIA's NemoClaw tool, used to deploy OpenClaw AI agents inside OpenShell sandboxes, exposes the local Ollama API on 0.0.0.0:11434 instead of restricting it to loopback, disabling Ollama's Host-header protection. Attackers can exploit this via DNS rebinding from a malicious webpage to gain unauthenticated control of the local model server, then modify Ollama's chat template to inject hidden instructions that persist across all future conversations, invisible to the agent and user. Discovered by Cyera's Oasis Identity Research and disclosed to NVIDIA's PSIRT, the issue is fixed in v0.0.35 for macOS and Linux, but Windows remains unpatched (v0.0.34 only shows an installation warning). A CVE is pending. Experts warn sandboxing alone isn't enough since an agent's authorized access to tools and APIs defines the real blast radius, and recommend treating agent-to-model traffic as its own monitored security layer.
Table of contents
Setting Up an NemoClaw Attack & ExploitationPoisoning the Model TemplateAI Agents Need New ProtectionsQuestions this post answers
What is the NemoClaw vulnerability that lets attackers poison OpenClaw AI agents?
A network misconfiguration in NVIDIA NemoClaw binds the Ollama API to 0.0.0.0:11434 instead of localhost and disables Ollama's Host-header check, letting a malicious webpage use DNS rebinding to gain unauthenticated control of the local model server. From there an attacker can enumerate, modify, or delete models and rewrite the chat template to inject hidden instructions that persist across every future conversation. Teams running local LLM agents can track disclosures like this on daily.dev before shipping agent infrastructure.
Is the NemoClaw Ollama API vulnerability patched?
Yes for macOS and Linux, no for Windows. Oasis Identity Research confirmed the fix landed in NemoClaw v0.0.35 for macOS and Linux, while Windows installations still lack a fix; v0.0.34 only adds a warning during Windows installation. A CVE tracking number was pending at time of disclosure to NVIDIA's PSIRT. Anyone patching AI agent tooling can follow fix status for issues like this on daily.dev.
Why is chat template poisoning worse than a normal prompt injection attack?
Because the poisoned instructions get appended directly to the agent's legitimate system prompt at inference time, making the tampering persist across all subsequent conversations while remaining invisible to both the agent and the user. Unlike a one-off prompt injection, remediation requires resetting the corrupted instructions in addition to patching the underlying vulnerability, according to security firm Detectify. Developers securing agentic AI pipelines can dig into threats like this on daily.dev.