A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

A vulnerability has been discovered in NVIDIA NemoClaw that could allow an attacker to gain unauthenticated control of a local AI model through a malicious webpage. This control could enable the attacker to embed hidden instructions within the model. The weakness was identified by Oasis Security, which reported its findings to NVIDIA's Product Security Incident team. Oasis Security shared its discovery with The Hacker News prior to public release. The vulnerability specifically targets the local Ollama instance that serves an AI agent.