Security researchers at Oasis Security disclosed a vulnerability on August 25 in NVIDIA's NemoClaw, a sandbox NVIDIA built to let AI agents like OpenClaw run locally, that let a single malicious webpage take unauthenticated control of the model server behind the agent and quietly plant instructions inside its responses. The flaw is tracked as CVE-2026-65105.

How the sandbox was supposed to work

NVIDIA released NemoClaw at its GTC conference in March as a safer way to run autonomous coding and browsing agents. It places an agent such as OpenClaw inside an "OpenShell" sandbox that restricts the file system, network access and processes the agent can touch, and lets the agent's underlying model run locally through Ollama rather than calling out to a cloud API — intended as a privacy and safety win over hosted alternatives.

Where the isolation broke down

According to reporting from The Hacker News, SiliconANGLE, Security Boulevard and Dark Reading, Oasis Security found that NemoClaw starts Ollama with the flag OLLAMA_HOST=0.0.0.0:11434, which exposes Ollama's API — which has no built-in authentication — on every network interface rather than just the local loopback address. Two middleware checks were meant to compensate: an origin allowlist and validation of the browser's Host header. Researchers found the Host-header check was skipped entirely whenever the bind address wasn't loopback, leaving only the origin check — which a well-known technique called DNS rebinding can walk around.

The practical result, per the researchers: simply visiting an attacker-controlled webpage — no phishing, no stolen credentials, no malware download — could be enough to reach the locally running Ollama instance, rewrite how it processes text, and inject a hidden prompt that the agent would then treat as legitimate instructions.

Patch status is incomplete

NVIDIA has shipped a fix in NemoClaw version 0.0.35 for macOS and Linux. Windows and WSL are not yet covered; version 0.0.34 added a Windows installation path that instead surfaces a warning to users rather than closing the hole. As of the disclosure on August 25, no in-the-wild exploitation had been reported, but researchers noted that end users still need to update to the patched version themselves — NemoClaw does not appear to force the upgrade automatically.

Why it matters for the agent ecosystem

The disclosure lands amid a broader run of AI-agent security findings this year and underscores a recurring theme: sandboxing an agent's file system and process access doesn't help if the network boundary around its own model server is left open. For teams running local, Ollama-backed agents in developer environments, the episode is a reminder to check bind addresses and authentication on any local inference endpoint exposed to a browser session, not just the agent's own permissions.