NVIDIA NemoClaw Cross-Site Ollama Model Poisoning via Malicious Webpage
First seen Aug 26, 2026 · Updated Aug 26, 2026
Researchers at Oasis Security found that a malicious webpage can reach an unauthenticated local Ollama instance running behind NVIDIA NemoClaw and use it to implant hidden instructions into the AI model itself. This effectively lets a remote attacker who only controls a webpage a victim visits achieve persistent, unauthenticated tampering with a locally hosted AI agent's behavior.
Technical Analysis
The core issue is that Ollama's local API, which NemoClaw relies on to serve the AI agent, is exposed without authentication on localhost, a common pattern in local-LLM tooling. A malicious webpage loaded in the victim's browser can issue cross-origin requests (a browser-based CSRF-style attack) directly to this local API, since browsers do not block requests to localhost the way they might restrict other network access. Through this channel the attacker can push modified model files, system prompts, or fine-tuning/adapter data into Ollama, effectively poisoning the model that NemoClaw's agent uses going forward. This crosses the boundary from an untrusted web origin into a trusted local-agent execution environment, turning passive browsing into a vector for persistent agent compromise without any credentials or explicit user consent.
Affected Systems
NVIDIA NemoClaw, Ollama
Detection Signatures
- Unexpected inbound HTTP requests to localhost Ollama port (default 11434) originating from browser-rendered pages
- Model/adapter file modifications on disk not correlated with user-initiated CLI/API actions
- Unusual Origin/Referer headers on local Ollama API requests indicating browser-based cross-origin calls
- Unexplained changes to system prompts or model weights/configuration timestamps
- Ollama process receiving API calls without corresponding legitimate application session
Remediation Steps
- 1
Enforce authentication on local Ollama API
Require API keys or tokens for all Ollama endpoints, even when bound to localhost, so browser-issued requests cannot succeed without credentials.
- 2
Restrict CORS and Origin validation
Configure Ollama/NemoClaw to reject requests lacking expected Origin headers or that originate from browser contexts, mitigating cross-origin driveby attacks.
- 3
Bind to loopback with strict access controls
Ensure the local inference server is not reachable via permissive interfaces and apply OS-level firewall rules limiting which local processes may connect.
- 4
Integrity verification for model artifacts
Implement checksums/signing for model weights, adapters, and system prompts, and alert on unauthorized modification.
- 5
Patch NemoClaw and Ollama
Apply vendor-provided fixes from NVIDIA and Ollama once available, addressing the unauthenticated local API exposure.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.