CVE-2026-65105 Lets Attackers Poison NemoClaw's AI Through a Browser Tab
What happened
Cyera researchers publicly disclosed CVE-2026-65105, a DNS rebinding vulnerability affecting Nvidia's NemoClaw platform, which uses a locally running Ollama model server as its inference backend. The attack requires no authentication: a victim visiting a malicious webpage allows the attacker's server to rebind its DNS name to the victim's local network address, giving it unauthenticated access to the Ollama API. From there, the attacker can manipulate the model's chat template to embed persistent, hidden instructions that survive subsequent sessions. Critically, these injected instructions do not appear in ordinary model metadata inspection, meaning routine governance checks would not surface the compromise. The implications extend well beyond a single product: any agentic pipeline trusting this model as a reliable instruction executor could be silently redirected toward attacker-controlled packages, suppressed security warnings, or covert data exfiltration. This finding sits alongside a broader pattern of self-hosted model attack surfaces documented in CVE-2025-9141 and the InjecMEM persistent agent instruction research.
Why it matters
- ·Self-hosted models are often governed with lighter controls than cloud-hosted alternatives, on the assumption that network isolation provides adequate protection. CVE-2026-65105 breaks that assumption: a browser tab is sufficient to reach a locally bound Ollama server, meaning perimeter controls are not a substitute for model integrity verification and chat template attestation.
- ·Organizations running agentic workflows on NemoClaw or similar Ollama-backed platforms face compounded risk, because injected instructions can silently redirect autonomous agent actions at scale. Without behavioral anomaly detection and runtime instruction monitoring, a poisoned model can operate undetected across every task the agent performs, creating liability exposure that spans data integrity, fraud, and potentially regulatory reporting accuracy.
- ·The invisibility of the injected instructions in standard metadata views creates a direct gap in audit readiness. If a model's effective instruction set cannot be verified at inspection time, AI decision logging and output audit trails lose evidentiary value, a concern that regulators applying frameworks such as the NIST Artificial Intelligence Risk Management Framework Playbook would flag as a material control failure.
Governance controls affected
What to do now
- ☐Identify all instances of NemoClaw and Ollama-backed model servers running in your environment and apply available patches or mitigations for CVE-2026-65105 immediately, prioritizing any instances accessible from browser-facing networks.
- ☐Implement network-level isolation for all local Ollama model servers, restricting binding to loopback or explicitly authorized internal addresses only, and verify that no browser-reachable interface exposes the Ollama API.
- ☐Establish a chat template and system prompt attestation process for every self-hosted model in your inventory: capture a cryptographic hash of the authorized template at deployment and alert on any deviation detected at runtime.
- ☐Review agentic workflows that rely on NemoClaw or Ollama-backed models for any tasks involving package installation, external API calls, or data egress, and suspend autonomous execution on those pipelines until model integrity is confirmed.
- ☐Update your AI incident response playbook to include a persistent instruction injection scenario, with defined steps for detecting invisible template modifications and assessing the scope of any actions taken by a potentially compromised agent.
What to watch next
Nvidia has not yet published a formal security advisory or patch timeline as of the disclosure date, so compliance teams should monitor Nvidia's product security channel and the NVD entry for CVE-2026-65105 for remediation guidance. The DNS rebinding attack class is also documented against MCP server deployments, as covered in CVE-2026-11624, suggesting regulators and standards bodies may begin addressing local AI server network binding requirements more broadly. Organizations subject to the NIST AI 600-1 Generative AI Profile should watch for updated guidance on self-hosted model integrity controls, as this class of attack is not yet addressed in most published AI security frameworks.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
Free every Thursday. Unsubscribe anytime.