Critical Security Flaw in NVIDIA NemoClaw
Malicious webpage could hijack your local AI model
1Vulnerability Discovery
Oasis Security uncovered a critical security flaw in NVIDIA's NemoClaw platform. This vulnerability allows a malicious webpage to take over the local Ollama instance and inject hidden commands into the AI model. The issue remains unpatched specifically on Windows and WSL environments. Oasis shared findings with NVIDIA's security team, but no CVE identifier has been assigned yet.
2Attack Mechanism
The attack exploits NemoClaw's binding of Ollama to all network interfaces. Attackers with API access can modify the model's chat template to append hidden instructions to every conversation. Using DNS rebinding, the attacker's domain first resolves to their server, then to 127.0.0.1. The browser continues treating requests as same-origin, bypassing security checks.
3Platform-Specific Status
While NemoClaw v0.0.35 fixed the issue for macOS and Linux, Windows and WSL paths remain vulnerable. Windows installations only received a warning message. NemoClaw's proxy check doesn't work on WSL paths, affecting Windows-host configurations. NVIDIA documentation warns Windows users against exposing port 11434 to LAN or internet.
4Ollama's Security History
Ollama's API previously suffered from DNS rebinding attacks. Version 0.1.29 released in March 2024 addressed this and was registered as CVE-2024-28224. However, Ollama skips Host header validation when bound to non-loopback addresses. NemoClaw's default 0.0.0.0 binding precisely triggers this security gap.
5Model Manipulation
Attackers can modify the Go template through /api/create endpoint. The poisoned template appends attacker-controlled text to every system message. Injected instructions persist across subsequent conversations and remain effective even when the agent provides its own system prompt. API consumers cannot detect these changes.
6Proxy Control Mechanism
NemoClaw v0.0.106 introduced a security measure rejecting Ollama backends bound to non-loopback interfaces. The proxy exits with a warning. However, this check doesn't work on WSL paths and can be disabled with NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1 setting. Windows-host configurations don't benefit from this protection.
7Lack of Template Integrity
The NemoClaw repository lacks chat template integrity checks. The platform only queries the model's native context length and tool-calling capability. NVIDIA's security guidance for Windows users recommends restricting network access, but DNS rebinding bypasses this as the browser already runs on localhost.
8Industry Implications
This vulnerability raises important questions about local AI model security. Oasis researchers previously documented similar techniques against Paperclip and OpenClaw agents. Rapid development cycles in AI infrastructure challenge security controls. The industry needs more robust protections against model manipulation risks.
Original article: The Hacker News — NVIDIA NemoClaw'da Kritik Güvenlik Açığı