It wasn’t phishing or a stolen credential. It was just a browser tab opened by a researcher. That’s all it took to seize control of a sandboxed NVIDIA AI coding agent.
Recently disclosed by Oasis Security (now merged with Cyera), the vulnerability is identified as CVE-2026-65105. It shows how NemoClaw—the NVIDIA tool for running the OpenClaw agent inside OpenShell sandboxes—quietly disables one of two built-in defenses provided by Ollama. The free, open-source Ollama software platform lets users download and run large language models (LLMs).
After NemoClaw is compromised, the containerized agent within Ollama can then reach the OpenClaw model server on a developer machine. Combined with DNS rebinding, that single misconfiguration hands an anonymous, remote attacker full API access to the local model. No login, no malware, and no second click required.
“An attacker can alter how the NemoClaw model reads every message it's handed—one layer beneath anything a guardrail or an operator can see,” notes Elad Luz, Head of Research at Oasis Security. “The change survives every future session, leaving an integrity problem that's very hard to detect. The sandbox doesn't help here: the blast radius of an AI system is its authorizations, not its isolation, and compromising the agent's behavior hands you everything it was permitted to reach. The broader trend is that agents are becoming identities with real entitlements, and we're still securing them like tools.”
Agents Take Orders from Someone Not in the Building
What happens next is unsettling: rather than injecting a prompt that an agent might eventually flush, an attacker can rewrite the template that turns every conversation into text that the model can read. This change survives across sessions and silently overrides the agent’s safety instructions.
The result: an AI coding assistant that keeps full access to source control and the cloud infrastructure while also quietly taking orders from someone who was never in the building.
It's the fifth disclosure from the same Oasis team on non-human identity and AI agent risks. In the fast-accumulating catalog of agent-sandbox failures, this is also the first disclosure since Oasis folded into Cyera. It arrives at a moment when patches exist for some platforms and not for others.
“The individual pieces here aren't new,” comments Randolph Barr, Chief Information Security Officer at Cequence Security. “DNS rebinding's been a browser party trick for over a decade, but pointing it at an unauthenticated local model server is the new part, and it's a good preview of where agentic AI risk actually lives. It's not really in the model; it's in the plumbing around it. Sandboxing the agent doesn't buy you much if the thing it's built on top of is reachable from any tab in the browser.”
How the Attacks Unfold
When these attacks occur, threat actors never touch the victim's machine. They don’t send malware, and they don’t need credentials. A single webpage visit is the entire initial access requirement.
Here’s how the attacks unfold:
- The compromised asset turns into an agent with live access to code and infrastructure.
- OpenShell isolates the OpenClaw agent inside a Docker container.
- Local inference (via the Ollama platform) requires the container to reach the model server on the host.
NemoClaw solves this by binding Ollama to listen for network requests on all available network interfaces instead of restricting it to just the local machine. The installer still tells the user the model is private to their machine.
One Binding Choice Erases Built-In Defense
Since the API has no authentication, Ollama relies on two defensive layers: CORS and Host Header Validation. Host Header Validation is supposed to block this kind of browser-based breach.
However, that check silently disables itself the moment Ollama isn't bound to the loopback mechanism. That means only one of two defenses provided by Ollama is left standing.
To finish the job, an attacker registers a domain that first resolves to the attacker’s server, then to the victim's local address. The browser's same-origin rules follow the hostname, not the resolved IP.
The CORS check passes because the origin and the host now match by design, not accident. As a result, full and unauthenticated access to every Ollama API endpoint follows
Why Attacks Rewrite the Model, Not the Prompt
Naive system-prompt injection gets overridden the moment the agent sends a system prompt. This allows an attacker to poison the Go template that renders every message into raw model input.
From there, the injected instruction rides along with the agent's system prompt, instead of being replaced by it. The poisoned template is invisible in the model name, size, and listed capabilities.
On every future session, the poisoned model also backdoors the code, suppresses security warnings, and steers toward malicious packages. The OpenShell isolation still holds at the container level, but that was never where the value sits.
The authorized access that agents gain to source control, CI/CD, and cloud accounts defines the actual blast radius. The <0.0.0.0> binding—where a network service listens for incoming connections on all available network interfaces on a machine—also exposes the API to anyone on the same LAN. No rebinding is needed.
A Pattern, a Partial Fix, and What's Still Exposed
This disclosure from Oasis follows similar disclosures pertaining to PromptFiction, Claudy Day, OpenClaw, and Envade. Oasis reported the findings to NVIDIA ahead of the CVE publication, and in NemoClaw v0.0.35, NVIDIA developed a fix for MacOS and Linux. For Windows (via the Windows Subsystem for Linux), NVIDIA shipped a warning in v0.0.34, with no fix yet available.
As for how enterprise security teams should react to this news, Ram Varadarajan, CEO at Acalvio, recommends that organizations assume an AI agent can inherit the trust—and vulnerabilities—of every system it can reach, including the model itself. “Security teams should therefore defend the entire runtime with network isolation, least privilege, continuous monitoring, and model-aware deception that deliberately feeds an attacking model misleading signals and decoys,” Varadarajan says. “The central lesson is simple: if attackers can manipulate what an agent sees, defenders must be able to manipulate what the attacker’s model sees.”
Collin Hogue-Spears, the Senior Director of Solution Management at Black Duck, points out that in the affected topology, Ollama answers on the network instead of loopback, so the browser can reach the model server. “The origin protection that normally keeps the browser out does not hold on this path,” adds Hogue-Spears. “DNS rebinding does the rest, carrying a web page into the unauthenticated model API. The technique is older than the AI stack it targets. The attacker's domain first resolves to its oer to load JavaScript. It then re-resolves to the loopback or local address. Now the same page talks to the unauthenticated model API under a hostname the browser still trusts. Ollama hardened this class of browser-to-local-service exposure in 2024 under CVE-2024-28224. The affected topology pairs broader reachability with that browser path, and the two together recreate the exposure the hardening removed.”
