Webpage Can Poison Local NVIDIA NemoClaw Models

Oasis Security has uncovered a flaw in NVIDIA’s NemoClaw that allows an attacker‑controlled webpage to take unauthenticated control over any locally hosted Ollama instance and embed hidden instructions directly inside the model itself.¹

The vulnerability stems from NemoClaw’s use of large language model (LLM) inference sandboxing techniques that, while conceptually sound, do not enforce strict validation of untrusted input.¹

The attack vector is similar to classic SQL injection flaws; it relies on JavaScript served by an attacker’s own server injecting malicious code into an Ollama session running on the victim’s machine.¹

In practice, Oasis demonstrated that a simple webpage could trigger the local Ollama process to accept injected prompts, effectively giving the attacker full command over the AI agent without requiring elevated privileges or authentication tokens. Once the instruction set is loaded, every subsequent query processed by the model would be influenced by the attacker’s payload.¹

After discovering the issue, Oasis reported the findings to NVIDIA’s Product Security Incident team before public disclosure. NVIDIA subsequently patched the specific vector that allowed the web page to reach the local inference engine, but the underlying principle remains relevant for all LLM deployments that trust external inputs without rigorous filtering.¹

Security specialists note that many organizations should audit their entire inference pipeline because prompt engineering can bypass security controls if not carefully designed. This reminds them of early adversarial examples against image classification models, which showed how easily such systems could be fooled when fed crafted inputs.¹

The implications are significant: attackers who poison a locally hosted NemoClaw model can alter its outputs, potentially generating misinformation, leaking sensitive data, or steering decisions in ways that compromise user privacy and system integrity. Users relying on NemoClaw for critical tasks—such as code generation, content moderation, or decision support—must now consider whether their environment truly isolates untrusted input from the core model logic.¹

While NVIDIA addressed the immediate attack vector, broader risk persists as threat actors continually devise new methods to subvert local AI models via seemingly innocuous webpages. The incident underscores the need for robust sandboxing, strict input validation, and continuous monitoring of any component that interfaces with an LLM’s execution context.¹