Local AI Poisoning: Malicious Webpages Can Hijack Ollama Instances Behind NVIDIA NemoClaw
Executive Summary
Cybersecurity researchers at Oasis Security have disclosed a critical security weakness in NVIDIA NemoClaw, NVIDIA's open-source reference stack used to deploy autonomous AI agents (such as OpenClaw inside OpenShell sandboxes) alongside local inference engines like Ollama (The Hacker News). The vulnerability allows an attacker-controlled public webpage to issue unauthenticated cross-origin API calls directly to a developer's locally running Ollama instance, taking unauthenticated control of the AI backend and persistently injecting malicious system instructions into the model's chat templates.
Deep-Dive Technical Analysis
The Browser-to-Localhost Attack Vector
As enterprises increasingly deploy local Large Language Models (LLMs) to process proprietary source code and sensitive internal data without cloud API latency, local inference frameworks have introduced unexpected host-level attack surfaces:
1. Unauthenticated Host-Port Exposure: On Windows and Windows Subsystem for Linux (WSL) environments, NemoClaw and Ollama setups frequently bind the inference service to OLLAMA_HOST=0.0.0.0:11434 without authentication so that containerized agent runtimes in Docker Desktop can communicate with the host daemon.
2. Browser-Driven Localhost Rebinding: When a software engineer or data scientist visits a seemingly innocuous webpage containing malicious JavaScript, the script issues background HTTP requests targeting http://127.0.0.1:11434 or http://localhost:11434. Because standard web browsers execute within the host network perimeter, these requests bypass external network firewalls entirely.
3. Chat Template Poisoning: The attacker's script interacts with Ollama's model creation and configuration endpoints (/api/create and /api/show). By pushing a modified Modelfile, the exploit overwrites the model's default TEMPLATE parameter, embedding hidden malicious system prompts directly into the local model configuration.
4. Persistent Inference Manipulation: When the developer subsequently uses the poisoned model or autonomous agent for coding or workflow automation, the injected instructions silently activate. The model can be instructed to insert subtle backdoors into generated code, execute rogue commands via agent tool-calling interfaces, or exfiltrate local files during web-browsing tasks.
AI Agent Threat Modeling & Environmental Gaps
Research led by Oasis Security's Elad Luz revealed distinct platform-specific security gaps:
* Missing Template Integrity Checks: Security audits revealed no chat-template cryptographic validation inside the framework repository; NemoClaw queried Ollama only for context length and tool-calling capabilities.
* WSL vs. Native OS Inconsistencies: While non-WSL hosts keep Ollama bound strictly to loopback behind token-gated reverse proxies on port 11435, Windows and WSL development setups often bypass the proxy to facilitate containerized networking, leaving port 11434 accessible without authentication.
Actionable Recommendations & Mitigations
1. Upgrade NemoClaw Installations: Update NemoClaw deployments immediately to version v0.0.35 or later, which enforces strict local loopback restrictions on supported platforms.
2. Enforce Loopback-Only Binding on Local Ollama: Ensure local Ollama instances explicitly bind strictly to 127.0.0.1:11434 rather than wildcard interfaces (0.0.0.0).
3. Implement Token-Gated Reverse Proxies: Never expose local model inference endpoints without bearer token authentication, even on internal developer loopback interfaces.
4. Audit Local Model Templates: Periodically verify local model manifests and Modelfiles using ollama show
________________
Sources & References: The Hacker News.