What happened
Oasis Security (via Cyera) disclosed CVE-2026-65105 on Aug 25, 2026: NemoClaw's Ollama configuration exposes an unauthenticated local inference API reachable via DNS rebinding from any webpage. An attacker can persistently poison the model's chat template so hidden instructions survive reboots and future conversations, invisible to the agent operator.
Why it matters
This demonstrates that agent sandboxing alone does not bound risk — a compromised local inference service can steer an agent that holds legitimate, authorized access to source control, CI/CD, cloud services, and MCP-connected tools, turning a browser visit into durable enterprise compromise.
Attack vector
Victim visits an attacker-controlled webpage; the page uses DNS rebinding to make the browser believe it is still talking to the attacker's domain while actually reaching the locally-bound Ollama API (127.0.0.1/LAN). Because Ollama's non-loopback binding lacks authentication, the attacker can call /api/create to rewrite the model's chat template, embedding hidden instructions that persist across all future agent sessions.
Affected systems
NVIDIA NemoClaw (OpenClaw agent wrapper) using local Ollama inference; patched in NemoClaw for macOS/Linux, no fix yet for Windows/WSL as of disclosure
Mitigation
Apply NVIDIA's vendor remediation (macOS/Linux); restrict Ollama binding to loopback only or require authentication; monitor /api/create and template-change events; apply least-privilege scoping to agent tool/credential access. No official fix yet for Windows/WSL deployments.