Security researchers at Oasis Security published findings on August 25, 2026 describing a flaw in NVIDIA's NemoClaw, a deployment wrapper NVIDIA ships to make it easy to stand up local AI agents backed by Ollama, that lets a single visit to an attacker-controlled webpage hijack the AI agent running on that machine, no user interaction beyond loading the page required. The root cause is mundane but consequential: NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the model server's API to every network interface instead of localhost only. Combined with a lack of authentication on that API, a malicious webpage can use a DNS-rebinding technique to talk directly to the local Ollama instance from the browser, bypassing the same-origin protections that would normally stop a webpage from reaching services on your own machine. Once it has that access, the attack calls Ollama's /api/create endpoint to silently rewrite the chat template the model uses to render conversation history into raw text before inference, meaning the attacker can splice hidden instructions into every system message the agent ever processes going forward. Because the poisoning happens at the template layer rather than in any single conversation, it persists across sessions, survives the agent supplying its own system prompt, and is invisible to anything inspecting the conversation through the normal API, which makes it a genuinely stealthy and durable compromise rather than a one-off prompt injection. NVIDIA shipped NemoClaw v0.0.35 patching the binding issue on macOS and Linux after Oasis reported it through NVIDIA's PSIRT process ahead of publication, but Windows and WSL users are still exposed as of this release. Anyone who has installed NemoClaw to run local agents, a growing pattern as developers move from cloud APIs to local-first AI tooling for cost or privacy reasons, should check their version immediately and treat any local model-serving tool bound to all interfaces as a serious attack surface, not a convenience feature.