A vulnerability in NVIDIA’s tool for deploying secure AI agents using OpenClaw could allow a cyberattacker to silently poison a large language model’s (LLM’s) chat template and corrupt the AI agents that are using it.
Researchers from Cyera’s Oasis Identity Research discovered the network configuration issue in NVIDIA NemoClaw, and, more specifically, its Ollama API, according to a report published today. The issue can expose the API to browser-based attacks that can allow attackers to persistently poison a model from which an AI agent receives instructions, according to the research.
NemoClaw is a tool used to deploy the open source OpenClaw AI agent framework inside NVIDIA OpenShell sandboxes, while Ollama is a popular open source runtime for running LLMs on local hardware. In NemoClaw, the API provides the tool with local model inference through an HTTP API on port 11434.
The issue that researchers found is that NemoClaw’s configuration of Ollama introduces a network exposure that can allow an attacker, through a malicious Web page and DNS rebinding, to gain unauthenticated control of the local model server. DNS rebinding is a well-known browser-based technique for reaching local services from remote Web pages.
“In short: a single visit to an attacker-controlled Web page is enough to hand the attacker full, unauthenticated control over the local model server that powers the agent,” according to the report. “From there, the attacker can silently plant hidden instructions inside the model itself, which the agent then obeys in every subsequent conversation.”
Oasis Identity Research responsibly disclosed the flaw to NVIDIA through its Product Security Incident Response Team (PSIRT). NVIDIA did not immediately respond to request for comment from Dark Reading, but a CVE tracking number is currently pending. Oasis confirmed to Dark Reading that the bug is fixed for MacOS and Linux (v0.0.35); but there’s no fix for Windows. However, v0.0.34 includes a Windows installation with a warning.
Setting Up an NemoClaw Attack & Exploitation
The flaw itself and how it’s exploited aren’t necessarily new — an exposed service, an unauthenticated API, and DNS rebinding are all common networking issues, experts say. However, “pointing it at an unauthenticated local model server is the new part, and it’s a good preview of where agentic AI risk actually lives,” observes Randolph Barr, chief information security officer (CISO) at API security and bot management provider Cequence Security, via email.
The opportunity to exploit begins with how NemoClaw configures Ollama. Because OpenShell runs in a container, NemoClaw starts Ollama on 0.0.0.0:11434 rather than restricting it to 127.0.0.1, making the unauthenticated API reachable beyond the host’s loopback interface, according to the researchers. That configuration also disables an Ollama Host-header check designed to prevent browser-based access.
An attacker can exploit this issue through DNS rebinding, the researchers demonstrated in their proof of concept. A malicious Web page initially loads from an attacker-controlled domain, which is then made to resolve to the victim’s local machine. Because the browser still considers the requests to come from the attacker’s domain, the page can interact directly with the local Ollama API without authentication, according to the report. From here, the attacker can then enumerate models, run inference, and modify or delete models.
Poisoning the Model Template
Perhaps the most dangerous aspect of the exploit is that it allows an attacker to modify Ollama’s chat template — the layer that converts OpenClaw’s structured messages, including its system prompt, into the text sent to the model, according to the report.
“OpenClaw often runs with access to many different systems and resources because it needs that access to automate tasks,” observes Rickard Carlsson, CEO of AI security firm Detectify. “If an attacker can control the agent’s behavior, that can effectively be like having full access to the machine.”
Indeed, inserting malicious instructions into that template can supply backdoor-generated code, instruct the model to suppress security concerns, or even exfiltrate data if the agent has outbound access, among other activities, according to the researchers.
Moreover, the attacker can cause those instructions to be appended to the agent’s legitimate system prompt at inference time, the researchers noted. This means that, unlike a conventional prompt injection, the poisoned template persists across conversations and is invisible to the agent and user.
Tampering with the agent’s instruction in this way also creates a messy remediation path, as organizations “would also need to include resetting those instructions rather than simply patching the underlying vulnerability,” Detectify’s Carlsson adds.
AI Agents Need New Protections
OpenClaw has already been plagued with a series of security woes since its meteoric rise in popularity among businesses, demonstrating the continued risks associated with moving too quickly to use and deploy AI agents across organizations. The latest issue in NemoClaw demonstrates yet again how a seemingly routine infrastructure decision can cascade into a critical vulnerability when combined with the absence of authentication and browser-based attack techniques, the researchers noted.
To mitigate such issues does require sandboxing the agent; however, this is not a sufficient protection, as it only protects the endpoint, “while the agent’s authorized access — to code, tools, APIs, and organizational resources — defines the true blast radius of a compromise,” according to the report.
Indeed, “sandboxing the agent doesn’t buy you much if the thing it’s built on top of is reachable from any tab in the browser,” Barr concurs. A better remedy than putting more guardrails inside the model, he says, is “treating agent-to-model and agent-to-API traffic as its own security layer that needs to be watched and controlled,” he says.
“Companies bolting agents onto infrastructure that was never built to see this kind of traffic are going to keep getting surprised by findings like this one,” Barr warns. “The organizations that get ahead of it are the ones putting a purpose-built gateway in front of their AI traffic now, instead of waiting for the next disclosure to force the conversation.”
Comments are closed