NVIDIA NemoClaw - Drive-By Agent Hijacking and Persistent Model Poisoning (CVE-2026-65105)
What Happened
On August 25, 2026, NVIDIA patched a critical, high-severity vulnerability (CVE-2026-65105, CVSS 8.1) in its NemoClaw for Linux framework, a popular system used to build and orchestrate AI agents. Discovered by researchers at Cyera, the flaw enabled a devastating attack class known as "Drive-By Agent Hijacking" and "Persistent Model Poisoning."
The vulnerability stems from a lack of authentication in NemoClaw's local inference server setup (which connects to the local Ollama engine). An attacker places a malicious payload on an ordinary webpage. When a developer using NemoClaw visits this webpage, the site uses DNS rebinding to trick the developer's browser into making unauthenticated requests to the locally running Ollama API. The attacker then manipulates the model's *chat template*—the core formatting layer that dictates how system and user prompts are presented to the model. By injecting malicious instructions directly into the chat template, the attacker permanently "poisons" the model's behavior. Because the chat template is stored locally and used for every new session, the malicious instructions persist across all future conversations, entirely bypassing any system-level prompt-injection filters or operator oversight, allowing the hijacked agent to silently exfiltrate credentials and code.
How MEG 1 would have acted
The persistent poisoning of a model's chat template represents a severe, undetectable compromise of behavioral alignment and system integrity, violating the core safety boundaries of the Index of Safety and Responsibility (ISR).
MEG 2 Analysis - Legal Framework
Agent level: N3 (individualized/advanced) - orchestration and inference system (NemoClaw) used to run local developer agents with file system and credential access.
Cause (6.1):
(a) system defect - the omission of authentication in the local inference server setup, and the vulnerability of the chat template architecture to persistent external manipulation (severe design defect), attributable to the manufacturer (NVIDIA).
(c) illicit diversion of control (hijacking via DNS rebinding) - the external attacker hijacked the local agent's core formatting layer to enforce persistent, unauthorized instructions (hijacking).
Attachment of liability: The manufacturer (NVIDIA) is fully liable for the system defect (6.1a) that allowed unauthenticated local API manipulation; the developers who deployed unpatched builds share liability under 9.4.
Procedural Mechanism
6.2 (architectural human confirmation): Modifying system files, updating chat templates, or altering local model configurations must require strict, token-based architectural human confirmation. Modifying these structural components must be technically blocked from occurring via unauthenticated browser endpoints.
9.4 (least privilege): Local model servers and APIs (such as Ollama) must never bind to 0.0.0.0 or allow unauthenticated local access without host-header validation, complying with the principle of least necessary access to prevent cross-origin or DNS-rebinding attacks.
7.1 (independent forensics): All changes to the local model configurations, system templates, and API access logs must be recorded in an unalterable, independent ledger to detect silent, persistent model poisoning before the compromised agent is executed.