--- title: "Finding Nemo(Claw): Issue Allows for LLM Poisoning in OpenClaw" url: https://daily.dev/posts/finding-nemo-claw-issue-allows-for-llm-poisoning-in-openclaw-eon3e5z4v source_url: https://www.darkreading.com/cyber-risk/nemo-claw-networking-llm-poisoning-openclaw type: article source: "Dark Reading" published: 2026-08-25T20:16:23.478Z updated: 2026-08-26T16:11:45.119Z tags: ["ai-agents", "prompt-injection", "ollama", "openclaw"] reading_time: 6 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Finding Nemo(Claw): Issue Allows for LLM Poisoning in OpenClaw **[Dark Reading](https://daily.dev/sources/dr)** · 6 min read · 0 upvotes · 0 comments ## Summary A network configuration flaw in NVIDIA's NemoClaw tool, used to deploy OpenClaw AI agents inside OpenShell sandboxes, exposes the local Ollama API on 0.0.0.0:11434 instead of restricting it to loopback, disabling Ollama's Host-header protection. Attackers can exploit this via DNS rebinding from a malicious webpage to gain unauthenticated control of the local model server, then modify Ollama's chat template to inject hidden instructions that persist across all future conversations, invisible to the agent and user. Discovered by Cyera's Oasis Identity Research and disclosed to NVIDIA's PSIRT, the issue is fixed in v0.0.35 for macOS and Linux, but Windows remains unpatched (v0.0.34 only shows an installation warning). A CVE is pending. Experts warn sandboxing alone isn't enough since an agent's authorized access to tools and APIs defines the real blast radius, and recommend treating agent-to-model traffic as its own monitored security layer. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the NemoClaw vulnerability that lets attackers poison OpenClaw AI agents? A network misconfiguration in NVIDIA NemoClaw binds the Ollama API to 0.0.0.0:11434 instead of localhost and disables Ollama's Host-header check, letting a malicious webpage use DNS rebinding to gain unauthenticated control of the local model server. From there an attacker can enumerate, modify, or delete models and rewrite the chat template to inject hidden instructions that persist across every future conversation. _Teams running local LLM agents can track disclosures like this on daily.dev before shipping agent infrastructure._ ### Is the NemoClaw Ollama API vulnerability patched? Yes for macOS and Linux, no for Windows. Oasis Identity Research confirmed the fix landed in NemoClaw v0.0.35 for macOS and Linux, while Windows installations still lack a fix; v0.0.34 only adds a warning during Windows installation. A CVE tracking number was pending at time of disclosure to NVIDIA's PSIRT. _Anyone patching AI agent tooling can follow fix status for issues like this on daily.dev._ ### Why is chat template poisoning worse than a normal prompt injection attack? Because the poisoned instructions get appended directly to the agent's legitimate system prompt at inference time, making the tampering persist across all subsequent conversations while remaining invisible to both the agent and the user. Unlike a one-off prompt injection, remediation requires resetting the corrupted instructions in addition to patching the underlying vulnerability, according to security firm Detectify. _Developers securing agentic AI pipelines can dig into threats like this on daily.dev._ ## Similar posts on daily.dev - [I ran Nvidia's NemoClaw to see if OpenClaw is finally safe, but it still has the same problems](https://daily.dev/posts/i-ran-nvidia-s-nemoclaw-to-see-if-openclaw-is-finally-safe-but-it-still-has-the-same-problems-rhnvxn8jt) · XDA Developers · 1 upvotes · 0 comments - [Four OpenClaw flaws let attackers steal data, escalate privileges, and plant backdoors through the agent’s own sandbox](https://daily.dev/posts/four-openclaw-flaws-let-attackers-steal-data-escalate-privileges-and-plant-backdoors-through-the-a-ctlflklqf) · The Next Web · 1 upvotes · 0 comments - [Build a Secure, Always-On Local AI Agent with OpenClaw and NVIDIA NemoClaw](https://daily.dev/posts/build-a-secure-always-on-local-ai-agent-with-openclaw-and-nvidia-nemoclaw-64lushnzq) · NVIDIA Developer · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#ollama](https://daily.dev/tags/ollama), [#openclaw](https://daily.dev/tags/openclaw) [View this post on daily.dev](https://daily.dev/posts/finding-nemo-claw-issue-allows-for-llm-poisoning-in-openclaw-eon3e5z4v)