A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw 恶意网页可能通过 NVIDIA NemoClaw 毒化你的本地 AI 模型

TL;DR

• Oasis Security disclosed a critical vulnerability in NVIDIA NemoClaw allowing malicious webpages to take unauthenticated control of local Ollama instances and inject hidden instructions into AI models
• The attack exploits Ollama being bound to 0.0.0.0:11434 on Windows/WSL paths, combined with DNS rebinding to bypass browser-origin request protections
• Attackers can modify the model's chat template via /api/create to append attacker-controlled text to every system message at inference time, persisting across conversations
• The vulnerability was fixed for macOS and Linux in NemoClaw v0.0.35, but remains unfixed on Windows and WSL paths as of August 25, 2026
• NemoClaw v0.0.106 introduced a bind-check proxy that refuses non-loopback Ollama backends, but this protection does not apply to the affected Windows-host configuration path

Why It Matters

This vulnerability demonstrates how local AI agent deployments can be compromised through seemingly isolated browser interactions, undermining the security assumptions of sandboxed AI agent architectures. It highlights a critical gap between NVIDIA's security documentation (which warns against LAN/internet exposure) and the actual attack surface (browser-based DNS rebinding requires no network exposure). For AI practitioners running local agents with Ollama, this represents a direct path to model poisoning that bypasses traditional perimeter security controls.

Technical Details

• Attack Vector: NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434 on Windows/WSL paths, binding the inference server to all network interfaces without authentication on port 11434
• Bypass Mechanism: The API relies on Host header checks and CORS middleware to block browser-originated requests, but when bound to non-loopback addresses, Ollama skips Host header validation entirely; DNS rebinding allows an attacker's domain to resolve first to their server, then to 127.0.0.1 while the browser treats requests as same-origin
• Model Poisoning Method: The payload writes a modified Go template through Ollama's /api/create endpoint; this template controls how structured messages are rendered into raw text before inference, appending attacker-controlled text to every system message
• Persistence: Poisoned instructions survive across conversations and override agent-supplied system prompts, as the template is a model-level property invisible to API consumers with no integrity checks in NemoClaw
• Platform Disparity: Non-WSL hosts correctly keep Ollama on 127.0.0.1:11434 behind a token-gated reverse proxy on 0.0.0.0:11435, while Docker Desktop on WSL skips the proxy entirely due to host.docker.internal resolution

Industry Insight

• AI agent frameworks must treat local inference backends as trust boundaries requiring the same authentication rigor as remote services; binding to 0.0.0.0 without authentication should be considered a critical misconfiguration regardless of sandboxing claims
• The pattern of "security through documentation" (warning users not to expose ports) is insufficient when the architecture itself creates attack surfaces accessible to browser-based threats; implement defense-in-depth with mandatory loopback binding and Host/Origin header validation
• Model template integrity verification should become a standard requirement in AI agent stacks, as poisoned chat templates represent a persistent, undetectable (to clients) backdoor that survives reboots and conversation resets

TL;DR

• NVIDIA NemoClaw存在安全漏洞，允许恶意网页通过DNS重绑定攻击劫持本地Ollama实例并植入持久化隐藏指令
• 攻击者可修改模型chat template，在每次推理时注入恶意内容，且客户端无法检测或阻止
• 漏洞已在macOS和Linux的v0.0.35版本修复，但Windows/WSL路径仍未修复
• 攻击利用Ollama绑定0.0.0.0时跳过Host头验证的设计缺陷，无需网络暴露即可本地完成
• 该漏洞无CVE编号，截至2026年8月25日尚无公开利用报告

为什么值得看

这篇报道揭示了本地AI推理服务的安全隐患，对部署NemoClaw的开发者至关重要。它展示了即使本地服务也可能被恶意网页利用，提醒AI从业者需要重视本地推理环境的安全配置。

技术解析

NemoClaw在Windows/WSL路径中将Ollama绑定到0.0.0.0:11434，导致API无认证且可被外部访问。攻击者通过DNS重绑定技术，让浏览器将请求发送到攻击者控制的域名，然后重定向到本地Ollama实例。Ollama在绑定非回环地址时会跳过Host头验证，这使得攻击者能够修改chat template并植入持久化的恶意指令。

行业启示

本地AI代理的安全防护需要重新评估，特别是当它们与浏览器交互时。开源AI框架应该默认采用更严格的安全配置，比如绑定到127.0.0.1而非0.0.0.0。