You know how it feels when you visit one sketchy website and your browser starts serving you ads for products you only thought about out loud? Now imagine that same website reaching past your browser entirely and quietly rewriting the brain of your AI coding assistant. That's the pitch of this week's most unsettling security disclosure.

One Tab Open, One Model Compromised

Oasis Security disclosed a flaw in NemoClaw, NVIDIA's open source reference stack for running agents like OpenClaw locally through Ollama. The problem starts with a default misconfiguration: NemoClaw binds Ollama to every network interface on the machine instead of just localhost, and Ollama's API doesn't properly check the Host or Origin headers when it's exposed that way.

That combination opens the door to a classic DNS rebinding attack — a malicious webpage's domain first resolves to the attacker's own server, then flips to 127.0.0.1 once the browser has already decided the connection is trustworthy. From there, the attacker can call Ollama's /api/create endpoint and quietly rewrite the model's chat template, planting hidden instructions into every future system message.

The Part Where Your Guardrails Can't See It Happening

Here's the genuinely nasty bit: the poisoned template lives one layer below anything a guardrail, an operator, or even the API itself can inspect. Oasis Security put it bluntly — the client simply cannot detect or prevent it, because the template is a model-level property. The manipulation survives restarts and outlasts the conversation that triggered it, quietly steering an AI coding agent toward inserting vulnerable code, burying security warnings, or recommending booby-trapped packages.

NVIDIA has patched macOS and Linux as of NemoClaw v0.0.35, but Windows and WSL users are still exposed — a later version added a proxy check that, notably, doesn't run on the WSL path where the hole remains open.

Turns out "it's just running locally" was never the safety blanket anyone assumed it was.

Bolting AI agents onto your dev workflow without checking what they're allowed to talk to is exactly the kind of blind spot we help clients close — let's talk about locking yours down.

Source: The Hacker News