One Bad Web Page Could Quietly Rewrite Your Local AI Model
Researchers at Oasis Security found that Nvidia's NemoClaw left a local Ollama server open to the whole network. Visiting a single malicious page was enough to plant hidden instructions in the model.
Security researchers at Oasis Security disclosed a flaw this week in NemoClaw, Nvidia’s tool for running an AI coding agent on your own machine. The bug, tracked as CVE-2026-65105, meant that simply visiting a booby-trapped web page could be enough for an attacker to plant hidden instructions inside the AI model running on your computer, without any password, download or phishing email involved.
Here is the chain. To make its Docker container talk to the model, NemoClaw starts Ollama, the popular tool for running AI models locally, with the setting OLLAMA_HOST=0.0.0.0:11434. That tells Ollama to listen on every network interface rather than just the machine itself, and Ollama skips a safety check on incoming requests whenever it is bound that way. An attacker then uses a technique called DNS rebinding, where a website they control briefly points its own address at your computer, so your browser treats requests to your local Ollama as if they came from that site. From there the attacker can call Ollama’s /api/create endpoint and rewrite the model’s chat template, the small piece of text that wraps every conversation before the model reads it. Anything added there gets silently appended to every system message from then on, survives restarts, and is invisible to whatever app is calling the model. NemoClaw v0.0.35 fixed this on macOS and Linux. On Windows and WSL there is still no fix, only a warning added to the installer.
What’s actually going on here: running AI models locally is genuinely good for privacy, but it quietly turns your laptop into a small server, and servers need the same care as any other server. Ollama’s default is safe: it listens only to your own machine. The damage here came from a tool overriding that default for convenience, which is one of the oldest patterns in security. The chat template detail is what makes this nastier than an ordinary break-in. The attacker does not steal your data and leave, they change how the model behaves, permanently and out of sight, so a coding agent could be told to slip a backdoor into code it writes for you and every answer would still look normal.
What this means for you: if you have never installed Ollama or NemoClaw, this does not touch you. If you run Ollama, check whether anything has set OLLAMA_HOST to 0.0.0.0; it should be 127.0.0.1, which means “this machine only”. NemoClaw users on macOS or Linux should update to v0.0.35 or later. On Windows or WSL there is no patched version yet, so the honest advice is to avoid running it on a machine you care about until there is. More broadly, this is a good habit to build early: local AI tools deserve the same scepticism you would give any other program that opens a network port, and a fresh model pull is the fastest way to undo a tampered template.
Sources
Source: https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
OpenAI Built Its Own Chip, and the First Benchmarks Are Good
Jalapeño, OpenAI's first custom inference chip with Broadcom, runs on 700 watts against Nvidia's 900 to 1,150. Independent analysis puts it 1.5 to 1.9 times ahead per kilowatt.
