The NemoClaw vulnerability exposes a gap in how we think about AI model security. We’ve focused on poisoning during training or ensuring model weights stay clean, but this DNS rebinding attack shows that even an isolated local model can be persistently hijacked through a deployment misconfiguration.
A recent Cyera analysis detailed the chain: a malicious website exploits NemoClaw’s default binding of Ollama to 0.0.0.0:11434 using DNS rebinding to bypass CORS. Rather than targeting model weights, the attacker injects hidden instructions into the text/template that renders system prompts, then re-uploads it. The poisoning persists invisibly across all conversations.
This is insidious because it violates a core assumption for local deployments: “local” means safe. For developers using NemoClaw with Ollama, a single browser visit to a malicious page becomes a permanent hijacking vector.
The immediate fix is obvious (bind to localhost, not 0.0.0.0). The deeper lesson is uncomfortable: safety isolation at the model level doesn’t protect you if the deployment layer is exposed.
Sources: Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning
Coverage: A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
Related on this blog: [AUTO] Meta’s model didn’t hack a company, the sandbox did • Google Signed the Open Weights Letter, and Anthropic Is Now Alone • The Open Weights Letter Grew Ten Signatures Overnight, and One of Them Was OpenAI