Oasis Security found that NVIDIA NemoClaw’s Windows-host Ollama path leaves an unauthenticated local model API reachable to a browser-mediated attack, and says macOS and Linux were fixed in v0.0.35 while Windows and WSL remain unpatched. The issue has no CVE and no reported exploitation as of August 25, 2026.
The attack uses DNS rebinding: a webpage starts on the attacker’s domain, then makes the browser talk to a service on the victim’s own machine as if it were same-origin. Because NemoClaw’s Windows-host path binds Ollama to all interfaces without auth, that request can change the model’s chat template and leave hidden instructions that persist into later chats.
For teams running local AI agents on Windows-host or WSL paths, the exposure is not a brief browser session but model state that can outlast the page. If the model service is reachable from the browser, web content can become a control path for the agent itself.