Oasis Security has identified a critical vulnerability in NVIDIA NemoClaw that permits attackers to compromise local AI models without authentication. The weakness allows malicious webpages to seize control of Ollama instances running on a user's system and inject hidden instructions directly into the model, a technique called prompt injection at the infrastructure level.
NemoClaw is NVIDIA's open-source framework designed to help developers build AI agents with large language models. Ollama is a popular tool for running LLMs locally on consumer hardware. The combination creates a deployment pattern where organizations and individuals run private AI instances on their machines. The vulnerability breaks the trust boundary between a compromised webpage and that local infrastructure.
An attacker hosting a malicious webpage could exploit this weakness through several vectors. If a user visits the compromised site while their Ollama instance runs in the background, the webpage gains unauthenticated access to the local model. This access persists beyond the initial compromise. The attacker can then plant hidden instructions, also called "jailbreak" prompts or system-level poisoning, that alter the model's behavior for all future interactions. Unlike traditional prompt injection attacks that work within a single conversation, this method contaminates the model itself.
The implications run deeper than a single user visiting a bad website. Organizations deploying NemoClaw for internal AI agents face risk if employees browse the internet on machines hosting these systems. The hidden instructions planted in a poisoned model could cause the AI agent to leak sensitive data, generate malicious code, provide incorrect analysis, or execute unauthorized actions. A financial services firm using a poisoned local model for fraud detection might miss alerts. A software development team relying on a compromised model for code review could accept vulnerable code.
Oasis Security reported the finding to NVIDIA's Product Security Incident Response Team before disclosing it publicly, following responsible disclosure protocols. NVIDIA has been notified and assigned a CVE identifier to track the vulnerability formally. Organizations using NemoClaw should monitor NVIDIA's security advisories for patch availability and deployment instructions.
Mitigation strategies for affected organizations include isolating machines running Ollama instances from general browsing, implementing network segmentation to restrict access to local AI infrastructure, and disabling unauthenticated access to Ollama where possible. Security teams should also audit any AI agents currently running to determine whether they may have been compromised prior to patching.
This vulnerability highlights a broader risk category in the emerging AI infrastructure landscape. As AI models migrate from cloud services to local deployments for privacy or performance reasons, the attack surface shifts. Local instances lack the security hardening of cloud providers. They run on employee workstations or smaller server environments. They often start without security configurations enabled by default. The boundary between browsing the internet and accessing sensitive AI infrastructure on the same machine creates an attractive target for attackers seeking to poison models or harvest training data.
The NemoClaw weakness represents a supply-chain risk for AI systems. Organizations cannot simply trust that a local model remains unaltered once compromised. Verification, monitoring, and isolation become essential controls for AI infrastructure deployments in 2024 and beyond.