Oasis Security has disclosed a weakness chain around NVIDIA NemoClaw in which an attacker-controlled webpage can reach the local Ollama instance backing an AI agent, take unauthenticated control of model-serving functionality, and plant hidden instructions inside the model artifact itself. The issue was reported to NVIDIA's Product Security Incident Response Team, according to the report shared with The Hacker News. No CVE identifier or fixed release is included in the cited material, so defenders should treat this as an actively relevant architectural exposure until NVIDIA and Oasis publish final technical guidance.
This matters because the target is not merely a chatbot response. If an attacker can influence the local model server, create or replace model artifacts, alter a system prompt, or pull a poisoned model, they can turn a developer workstation, research node, or production agent host into a persistent execution proxy. The malicious logic can survive ordinary prompt resets because it is embedded in the model configuration or template that the agent trusts.
What happened and who is at risk
The reported pattern is a browser-to-localhost attack against the AI stack: a victim visits a malicious page, script in that page attempts to interact with locally reachable services, and the NemoClaw/Ollama path is abused so the attacker can issue model-management or inference actions without meaningful authentication. The highest-risk environments are developer laptops, AI research workstations, agent runtime hosts, and small production deployments where Ollama is installed for convenience and assumed to be safe because it is local.
The dangerous assumption is that loopback equals trusted. Modern browsers, DNS rebinding, permissive local proxies, permissive CORS behavior, overly broad network namespaces, and agent frameworks that bridge web content to local tools can collapse that boundary. If Ollama is bound beyond 127.0.0.1, fronted by an unauthenticated proxy, reachable from a browser context, or administered through a NemoClaw component that forwards web-originated instructions, the exposure increases sharply.
Severity should be treated as high for any environment where agents can read sensitive data, call tools, access code repositories, browse internal systems, or execute actions through plugins. Even without confirmed in-the-wild exploitation in the cited item, the prerequisites are common: local model servers are widespread, model artifacts are rarely integrity-checked like binaries, and many teams do not log local API calls to 127.0.0.1.
Technical analysis
Affected components in scope are NVIDIA NemoClaw deployments that connect an agent workflow to a local Ollama server, and Ollama instances that are reachable from web content, another container, another host, a tunnel, or an unauthenticated local proxy. Exact vulnerable versions are not specified in the provided summary and no CVE is listed; do not invent one. Validate version exposure against the forthcoming NVIDIA PSIRT bulletin and the Oasis Security technical write-up.
Ollama commonly serves HTTP on TCP 11434 and defaults to localhost on many installs, but real-world deployments frequently weaken that boundary through OLLAMA_HOST changes, Docker port publishing, SSH tunnels, ngrok or cloudflared exposure, Kubernetes port-forwarding, socat relays, or reverse proxies. Relevant API surface includes model inference and model-management operations such as generate, chat, create, pull, push, copy, delete, show, and embeddings. A defensive model of the attack chain is:
- Victim browses to attacker-controlled content while a local agent stack is present.
- The page probes loopback or predictable private addresses for Ollama or a NemoClaw bridge, using browser requests, rebinding, or a permissive local relay.
- The attacker reaches an unauthenticated endpoint that can infer against the current model, inspect configuration, create a model from a malicious Modelfile, pull an attacker-named model, overwrite a template, or alter system-level instructions.
- The planted instruction set biases later agent behavior: exfiltrate context, prefer a malicious tool, hide actions from the user, rewrite code, or preserve attacker objectives across sessions.
- Persistence lives in model artifacts under the Ollama models directory, agent configuration, cached prompts, or downstream vector/tool memory rather than in a traditional malware binary.
Defenders should treat model manifests, Modelfiles, templates, system prompts, adapter files, and pulled blobs as code. If your organization would alert on an unauthorized package install or service unit change, it should alert on an unexpected ollama create, pull, delete, copy, push, template change, or manifest write.
Exploitation status based on the supplied item: researcher-disclosed, reported to NVIDIA PSIRT, no public CVE, no CISA KEV listing cited, and no confirmed mass exploitation included in the summary. That does not mean theoretical. The technique class is practical, and the absence of endpoint telemetry on local AI APIs makes it attractive.
Detection and response
The core detection strategy is to bind identity and provenance to every model change. A legitimate developer may run ollama pull llama3.1 during onboarding; it is far less normal for a browser, tunnel utility, script interpreter, build agent, or unknown local process to invoke model-management endpoints, publish 11434 externally, or rewrite model manifests.
---
title: Browser or Script Host Interacting With Local Ollama API
tid: 5b2d7c21-8a44-4f7e-9c2a-7d31a0b9e410
status: experimental
description: Detects browsers, script hosts, or command-line HTTP clients referencing local Ollama API or model-management endpoints, consistent with a malicious webpage or injected agent path attempting to control local model serving.
references:
- https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/18
tags:
- attack.execution
- attack.command_and_control
logsource:
category: process_creation
product: windows
detection:
selection_client:
Image|endswith:
- '/chrome.exe'
- '/msedge.exe'
- '/firefox.exe'
- '/brave.exe'
- '/powershell.exe'
- '/pwsh.exe'
- '/wscript.exe'
- '/cscript.exe'
- '/rundll32.exe'
- '/curl.exe'
- '/wget.exe'
- '/python.exe'
- '/node.exe'
selection_endpoint:
CommandLine|contains:
- '127.0.0.1:11434'
- 'localhost:11434'
- ':11434/api/create'
- ':11434/api/pull'
- ':11434/api/delete'
- ':11434/api/push'
- ':11434/api/copy'
- ':11434/api/generate'
- ':11434/api/chat'
condition: selection_client and selection_endpoint
falsepositives:
- Local AI developers testing Ollama from scripts or browser-based tooling
- Approved agent frameworks with documented localhost inference
level: high
---
title: Suspicious Ollama Model Management or Modelfile Change
tid: 2fb09d3e-61d9-4c6b-a52c-0a3c3a921e77
status: experimental
description: Detects Ollama model create, pull, delete, copy, or push activity, especially when paired with Modelfile, SYSTEM, TEMPLATE, or Ollama model path references that may indicate prompt persistence or model poisoning.
references:
- https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1554/
author: Security Arsenal
date: 2026/08/18
tags:
- attack.execution
- attack.persistence
logsource:
category: process_creation
product: windows
detection:
selection_action:
CommandLine|contains:
- 'ollama create'
- 'ollama pull'
- 'ollama delete'
- 'ollama copy'
- 'ollama push'
selection_artifact:
CommandLine|contains:
- 'Modelfile'
- '.ollama/models'
- 'SYSTEM '
- 'TEMPLATE '
- 'FROM '
condition: selection_action and selection_artifact
falsepositives:
- Legitimate model lifecycle management by developers and MLOps
level: medium
---
title: Tunnel or Relay Exposing Local Ollama Service
tid: 9a1c6fd4-2e73-4a0d-bb8a-6f0b76d2c934
status: experimental
description: Detects tunneling, port-forwarding, or relay utilities configured to expose TCP 11434 or Ollama beyond the local host, reducing the safety of localhost-only model serving.
references:
- https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
- https://attack.mitre.org/techniques/T1090/
- https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/08/18
tags:
- attack.command_and_control
- attack.exfiltration
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- '/ngrok.exe'
- '/cloudflared.exe'
- '/socat.exe'
- '/ssh.exe'
- '/plink.exe'
- '/frpc.exe'
- '/chisel.exe'
selection_expose:
CommandLine|contains:
- '11434'
- 'ollama'
- '-L 11434'
- '-R 11434'
- 'tcp://127.0.0.1:11434'
condition: selection_tool and selection_expose
falsepositives:
- Approved remote development tunnels documented by engineering
level: high
let ollamaIndicators = dynamic(['127.0.0.1:11434','localhost:11434',':11434/api/create',':11434/api/pull',':11434/api/delete',':11434/api/push',':11434/api/copy','Modelfile','ollama create','ollama pull','OLLAMA_HOST=0.0.0.0']);
let riskyClients = dynamic(['chrome.exe','msedge.exe','firefox.exe','powershell.exe','pwsh.exe','curl.exe','wget.exe','python.exe','node.exe','ngrok.exe','cloudflared.exe','socat.exe','ssh.exe','ollama']);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (riskyClients) or InitiatingProcessFileName in~ (riskyClients)
| where ProcessCommandLine has_any (ollamaIndicators)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort == 11434 or RemotePort == 11434
| where not(RemoteIP in ('127.0.0.1','::1'))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalIP, LocalPort, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc;
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ('ollama','docker','sshd','cloudflared','ngrok','socat') or SyslogMessage has_any (ollamaIndicators)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc
-- Hunt local AI model-control behavior, exposed listeners, and recent Ollama artifact changes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(11434|/api/(create|pull|delete|push|copy|generate|chat)|ollama (create|pull|delete|copy|push)|Modelfile|OLLAMA_HOST[ ]*=[ ]*0[.]0[.]0[.]0)'
OR Name =~ '(?i)(ollama|nemoclaw|cloudflared|ngrok|socat|chisel)'
SELECT Pid, Name, Laddr, Raddr, Status
FROM netstat()
WHERE Laddr =~ ':11434'
OR Raddr =~ ':11434'
SELECT FullPath, Mtime, Size
FROM glob(globs='/**/.ollama/models/manifests/**/*', accessor='file')
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC
# Verify and harden Windows hosts running Ollama/NemoClaw without deleting evidence
$ErrorActionPreference = 'SilentlyContinue'
Write-Host '== Processes touching Ollama or local AI tooling =='
Get-CimInstance Win32_Process | Where-Object { $_.Name -match 'ollama|nemoclaw|cloudflared|ngrok|socat|chisel' -or $_.CommandLine -match '11434|api/create|api/pull|api/delete|Modelfile|OLLAMA_HOST' } | Select-Object ProcessId,Name,CommandLine | Format-List
Write-Host '== TCP 11434 listeners and connections =='
Get-NetTCPConnection -LocalPort 11434 | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess | Format-Table -AutoSize
Write-Host '== Firewall exposure for 11434 =='
Get-NetFirewallRule -Direction Inbound -Action Allow | Where-Object { ($_ | Get-NetFirewallPortFilter).LocalPort -eq 11434 } | Select-Object DisplayName,Enabled,Profile | Format-Table -AutoSize
Write-Host '== Blocking inbound 11434 except loopback; review before enforcement in production =='
New-NetFirewallRule -DisplayName 'Block Ollama 11434 Inbound' -Direction Inbound -Protocol TCP -LocalPort 11434 -RemoteAddress Any -Action Block -Profile Any -ErrorAction SilentlyContinue | Out-Null
[Environment]::SetEnvironmentVariable('OLLAMA_HOST','127.0.0.1','User')
Write-Host '== Recent model manifest writes =='
$modelRoot = Join-Path $env:USERPROFILE '.ollama/models'
if (Test-Path $modelRoot) { Get-ChildItem $modelRoot -Recurse -Force | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | Select-Object FullName,LastWriteTime,Length | Sort-Object LastWriteTime -Descending | Format-Table -AutoSize }
Write-Host '== Manual checks: confirm OLLAMA_HOST is 127.0.0.1, remove inbound allows, re-pull models from trusted sources, and capture logs before cleanup =='
# Verify and harden Linux/macOS hosts running Ollama/NemoClaw without deleting evidence
set -u
printf '%s
' '== Listeners on 11434 =='
(ss -lntup 2>/dev/null || lsof -nP -iTCP:11434 -sTCP:LISTEN) | grep ':11434' || true
printf '%s
' '== Processes and command lines of interest =='
ps -eo pid,user,comm,args | grep -Ei 'ollama|nemoclaw|cloudflared|ngrok|socat|chisel|11434|api/(create|pull|delete|push)|Modelfile|OLLAMA_HOST' | grep -v grep || true
printf '%s
' '== Systemd override to force loopback binding =='
sudo mkdir -p /etc/systemd/system/ollama.service.d
printf '%s
' '[Service]' 'Environment=OLLAMA_HOST=127.0.0.1' 'NoNewPrivileges=true' 'PrivateTmp=true' | sudo tee /etc/systemd/system/ollama.service.d/override.conf >/dev/null
printf '%s
' '== Firewall examples; choose only one that matches your platform =='
sudo ufw deny in to any port 11434 proto tcp comment 'Block Ollama inbound' 2>/dev/null || true
printf '%s
' 'sudo iptables -A INPUT -p tcp --dport 11434 -j DROP'
printf '%s
' '== Recent Ollama model artifact changes =='
for d in "$HOME/.ollama/models" /usr/share/ollama/.ollama/models; do [ -d "$d" ] && find "$d" -type f -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM:%TS %p %s\n' | sort -r; done
printf '%s
' '== Audit for embedded instruction markers =='
grep -RInE 'SYSTEM|TEMPLATE|FROM|PARAMETER' "$HOME/.ollama" /usr/share/ollama/.ollama 2>/dev/null | head -200
printf '%s
' 'Next: sudo systemctl daemon-reload && sudo systemctl restart ollama only after capturing volatile evidence and confirming business impact'
Remediation and hardening
Apply the NVIDIA fixed release as soon as NVIDIA PSIRT publishes one for NemoClaw, and track the Oasis Security disclosure for exact reproduction conditions. As of the cited summary, no CVE, CVSS score, patch version, or CISA KEV entry is available, so interim compensating controls are required. Start with the sources most likely to carry authoritative updates: the original report at https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html, NVIDIA's security portal at https://www.nvidia.com/en-us/security/, and Ollama API/deployment documentation at https://github.com/ollama/ollama/blob/main/docs/api.md.
Immediate actions:
- Bind Ollama to 127.0.0.1 unless there is a documented production reason otherwise. Never expose 11434 through Docker -p 11434:11434, OLLAMA_HOST=0.0.0.0, Kubernetes NodePort/LoadBalancer, SSH -R, ngrok, cloudflared, socat, or a reverse proxy without authentication, allowlisting, mTLS, and logging.
- Put an authenticated control plane in front of model management. Inference may be internal, but create, pull, delete, copy, push, template, and system-prompt changes require strong identity, approval, and audit.
- Block browser-to-localhost pivoting. Enforce Private Network Access, DNS rebinding protections, egress proxy rules that deny public-origin requests to loopback and RFC1918 AI ports, and browser policies that prevent untrusted extensions from reading local responses.
- Establish model provenance. Maintain an allowlist of approved model names, digests, registries, and Modelfile templates. Re-pull models from trusted sources after suspicion, verify manifests and blob hashes, and alert on drift.
- Reduce agent blast radius. Run NemoClaw/Ollama under least privilege, disable unneeded tool plugins, isolate browsing from credential stores, separate development from production agents, and require human approval for high-impact actions.
- Add logging where localhost was previously invisible. Forward Ollama service logs, process creation, network listeners, file changes under model directories, and reverse-proxy access logs to the SIEM. Treat model creation and template edits like privileged package installation.
- If compromise is suspected: isolate the host, stop the agent, preserve memory and the full .ollama tree, capture process and network telemetry, snapshot container images, rotate credentials reachable by the agent, review downstream commits and tickets, rebuild from known-good configuration, and reintroduce only signed or hash-verified models.
Longer term, fold AI serving into vulnerability management and secure SDLC. Inventory every NemoClaw, Ollama, LangChain-style tool bridge, vector store, and model registry. Include model artifacts in SBOM and asset inventory. Add prompt-injection and tool-abuse cases to threat models. Exercise an IR playbook for poisoned models, because traditional malware cleanup will miss persistence hidden in templates, system instructions, embeddings, or cached agent memory.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.