NVIDIA NemoClaw

Overview

Security researchers at Oasis Security have disclosed a weakness in NVIDIA’s NemoClaw reference stack that could allow a malicious webpage to hijack a local Ollama instance and plant hidden instructions inside the AI model itself. This vulnerability highlights the risks of browser‑to‑localhost attacks and the importance of strict binding and header validation when running local inference backends.

How the Attack Works

• Binding issue: NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, exposing the API to every network interface.
• No authentication: The API on port 11434 lacks authentication, relying only on middleware checks.
• CORS bypass: When bound to 0.0.0.0, Host header checks are skipped, and CORS treats attacker requests as same‑origin.
• DNS rebinding: The attacker’s domain resolves first to their server, then to 127.0.0.1, tricking the browser into treating requests as local.
• Template poisoning: Attackers overwrite the chat template via /api/create, appending hidden instructions to every system message. These persist across conversations and are invisible to API consumers.

Platform Differences

• macOS/Linux: Fixed in NemoClaw v0.0.35.
• Windows/WSL: Still vulnerable; binding remains on 0.0.0.0:11434.
• Docker Desktop on WSL: Skips proxy, exposing Ollama directly.
• Non‑WSL hosts: Use loopback (127.0.0.1) with a token‑gated proxy, reducing exposure.

Why It Matters

• Agent takeover: Poisoning the model’s template means attackers control every inference.
• Invisible manipulation: Clients cannot detect or prevent template changes.
• Persistence: Instructions survive across sessions and override system prompts.
• Cross‑platform risk: Windows and WSL paths remain exposed, making enterprise deployments vulnerable.

Defensive Guidance

Organizations and developers should:

• Bind Ollama to loopback (127.0.0.1) instead of 0.0.0.0.
• Validate Host and Origin headers to block rebinding attacks.
• Monitor unusual API activity, especially template modifications.
• Isolate vulnerable hosts until patched.
• Avoid exposing port 11434 to LAN or internet.

Expert in the Cloud Insight

This disclosure shows how local AI stacks can be poisoned through browser tricks, even without direct network exposure. The lesson is clear: local inference does not mean local safety. Binding, header validation, and template integrity checks are essential to prevent silent model manipulation.