A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
- ID
- 17709
- Status
- summarized
- Published
- 25 Aug 2026, 10:07 PM
- Fetched
- 26 Aug 2026, 12:48 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.0
- Created
- 26 Aug 2026, 12:48 AM
- Tags
- Audience
- developersai_agent_usersai_ml_learners
What happened
Oasis Security disclosed that NVIDIA NemoClaw's Ollama integration binds to 0.0.0.0:11434 without authentication on Windows/WSL, letting a malicious webpage modify the model's chat template and plant persistent hidden instructions. NemoClaw v0.0.35 fixes this on macOS and Linux, but Windows/WSL remains unfixed at v0.0.34 with only a warning. The core issue—Ollama's API on port 11434 having no auth and Ollama's own docs advising 0.0.0.0 binding in container/WSL setups—extends beyond NemoClaw to anyone running Ollama locally.
Why it matters
If you run Ollama locally (with or without NemoClaw), check whether OLLAMA_HOST is set to 0.0.0.0:11434—any webpage you visit could hit that unauthenticated API and silently alter your model's chat template. On Windows/WSL with NemoClaw, there is no fix yet; pin to loopback (127.0.0.1) or firewall port 11434. For Malaysian builders running local LLMs for cost or data-sovereignty reasons, this is a concrete attack surface to close before deploying agents that have tool access.
Discussion angle
The broader lesson: Ollama's default lack of authentication on its API is a latent risk for anyone exposing it beyond loopback—how should local-model practitioners in Malaysia safely expose Ollama to containers or remote clients without opening this door?