NVIDIA NemoClaw Flaw Allows AI Agent Poisoning via Browser Tabs

A critical security vulnerability in NVIDIA NemoClaw allows attackers to hijack or poison AI agents simply by tricking a user into visiting a malicious website. The flaw creates a direct path for external web content to manipulate the internal logic of an AI agent.

Tracked as CVE-2026-65105, the vulnerability stems from how NemoClaw—a deployment wrapper for the OpenClaw AI agent ecosystem—handles networking. According to reports from Dark Reading, the exploit works by exposing the local Ollama model server used by NemoClaw to browser-based attacks. When a victim visits a compromised webpage, the site can send requests to the local server, enabling the persistent poisoning of the AI model's behavior and its chat templates.

The Mechanics of the Attack

This attack vector is a form of indirect prompt injection combined with server-side manipulation. Rather than simply tricking the AI with a clever sentence, the exploit targets the underlying infrastructure. By accessing the Ollama server, an attacker can fundamentally alter how the agent processes information or responds to the user, ensuring the poisoning remains in effect even after the malicious tab is closed.

Why It Matters

This discovery highlights a systemic risk for the growing category of AI-integrated browsers and autonomous agents. As users grant AI agents deeper access to their web browsing sessions to automate tasks, the browser becomes a primary attack surface. If a simple page load can compromise the core behavior of a local LLM, the trust model for autonomous agents is severely undermined, potentially allowing attackers to steal data or misdirect users through manipulated AI responses.

What's Next

Security researchers are now focusing on how other AI wrappers and local model servers secure their internal APIs against browser-based requests. While CVE-2026-65105 specifically impacts NemoClaw, the industry must determine if similar networking oversights exist in other OpenClaw-based deployments or competing AI agent frameworks. Users are advised to keep their deployment wrappers updated and restrict local server access to trusted interfaces.