Your AI agent visited a webpage last week, and it hasn't been the same since.
That's the scenario NVIDIA just patched with CVE-2026-65105, a critical vulnerability in NemoClaw tracked by researchers at Oasis Security.
It all started with one malicious webpage visit. Unlike traditional tactics, no credentials were stolen from the admin, no manager clicked a phishing email, and no one executed third-party code.
Yet, an attacker could plant a persistent malicious instruction inside your local AI agent's model context.
Now the agent would carry the instruction forward into every task after that. It will behave exactly as the attacker told it.
How this happened: let's think it through
NemoClaw leaves a local Ollama port exposed by default, and the attacker used a DNS rebinding trick to get a webpage's JavaScript to reach it. That's it.
The attacker didn't need to break into the model. All that was required was to talk to an unauthenticated API that the agent was already listening to.
Is a local AI agent safe?
I have consistently heard from founders and CTOs who claim that "local AI agent" is safer than the cloud. You are in control, there is no third-party server, and no data leaves your machine.
And honestly, that instinct isn't crazy. Local is better for a lot of threat models. But it was never the right frame for prompt injection and agent hijacking.
Because the execution environment is the perimeter here.
Status?
NVIDIA patched the vulnerability on macOS and Linux. Windows and WSL users on v0.0.34 got a warning banner instead of a fix.
So right now, there's a known, unpatched path on the most widely deployed developer OS to permanently alter how a local AI agent behaves, and the recommended action is: read the warning.
I like to call this a remediation gap.
When a fix exists but still leaves a meaningful slice of the affected population exposed. And it's not intentional neglect. When you are running a complex software ecosystem, it's exactly how patching works.
So for anyone running AI agents on Windows today, "the vendor is aware" is not a security posture.
Prevent accidental data leaks to ChatGPT, Claude, and Gemini.
Sequirly scans your prompts and uploaded files before they're sent. If it finds credentials, client records, or API keys, it stops you before the request goes out.
What it reveals about the category.
NemoClaw isn't just an NVIDIA problem. It's an example of what happens when we deploy AI agents into execution environments we haven't fully thought through, where unauthenticated local APIs, browser-accessible surfaces, and persistent model context all share the same trust boundary. Or rather, where there's no real trust boundary at all.
This is exactly the architecture that makes indirect prompt injection so dangerous in agentic systems.
You don't have to compromise the model to compromise the agent. Instead, you compromise something the agent trusts: a webpage it visits, a document it reads, an API it calls, and you're in.
And persistent model context just makes the damage durable.
The security has to be where the work happens. That's the principle we built Sequirly around. And NemoClaw is one more illustration of why: the work is happening in agent runtimes, on local machines, through browser-adjacent surfaces, and the security conversation is still mostly happening at the model layer.
Most teams deploying AI agents today have thought carefully about which model to use. They haven't thought much about what the model can reach, who can reach the model, and what it would mean if someone planted a hidden instruction and let it run.
A question worth sitting with: what does your AI agent have access to, and who else could talk to it without you knowing?
Sources: CVE-2026-65105 via Oasis Security | The Hacker News | Dark Reading | SiliconANGLE