A malicious website can rewrite your local AI model's behavior without you knowing. Researchers at Cyera discovered this vulnerability in Nvidia's NemoClaw AI assistant, highlighting the urgent need for robust security measures in local AI deployments.
What Happened
Cyera's team found that an attacker could control NemoClaw's underlying Ollama model server through DNS rebinding. Here's how it works: you visit a compromised website, which uses DNS rebinding to bypass the same-origin policy. Suddenly, the attacker has unauthenticated access to your local Ollama server. They can then modify the model's chat template, injecting instructions that persist across all future conversations. Your AI assistant is compromised until you manually fix it.
Timeline
While specific discovery and disclosure dates weren't published, we know:
- Cyera discovered the vulnerability during security research.
- Nvidia was notified through responsible disclosure.
- Nvidia issued an update for customers to download and install.
- The vulnerability affects NemoClaw installations running on local Ollama servers.
Which Controls Failed
Three security controls were either missing or ineffective:
Authentication bypass: The Ollama server accepted requests without verifying the caller's identity, allowing any process that could reach the server's network interface to modify its configuration.
Network boundary enforcement: The server was accessible to browser-based attackers. DNS rebinding worked because the server didn't validate that requests came from legitimate sources.
Input validation on system prompts: The model accepted arbitrary modifications to its chat template without verifying the source or integrity of those changes. Once modified, the poisoned template persisted across sessions.
What the Standards Require
OWASP ASVS v4.0.3 Requirement 4.1.1 states: "Verify that the application enforces access control rules on a trusted service layer." The Ollama server violated this by accepting unauthenticated requests from any network source.
NIST 800-53 Rev 5 Control AC-3 (Access Enforcement) requires systems to "enforce approved authorizations for logical access to information and system resources." The server's lack of authentication meant no authorization decisions could be made.
ISO/IEC 27001:2022 Control 8.3 (Information Access Restriction) mandates restricting access to information and system functions based on business requirements. A local AI model server should never accept configuration changes from arbitrary network sources.
PCI DSS v4.0.1 Requirement 6.4.3 addresses authorization for scripts and commands, requiring that "access to script files is restricted to only authorized personnel or accounts." While this targets payment systems, the principle applies: configuration changes to system behavior need authorization controls.
The DNS rebinding attack exploits a gap in browser security models, but the real failure is accepting those requests at all. Your AI server shouldn't rely on the browser's same-origin policy for protection.
Lessons and Action Items
Implement authentication on all management interfaces: If your AI model runs a local server with an API, that API needs authentication. Add API keys, mutual TLS, or origin validation that can't be bypassed through DNS rebinding.
Bind services to localhost only: If your AI model server only needs to accept connections from the local machine, configure it to listen on 127.0.0.1 instead of 0.0.0.0. This prevents network-based attacks entirely. Check your Ollama configuration and similar tools.
Validate configuration changes: When your AI model accepts updates to system prompts or templates, implement integrity checks. Sign templates, maintain a whitelist of allowed sources, or require administrator approval for changes.
Monitor for unauthorized modifications: Set up alerts for changes to your AI model's configuration. Log all API calls that modify model behavior.
Apply vendor patches immediately: Nvidia issued an update for this vulnerability. If you're running NemoClaw or similar AI tools, check for patches now. Subscribe to security advisories from your AI platform vendors.
Review all local AI deployments: This isn't just about NemoClaw. Any AI model running on local infrastructure with a management API could have similar issues. Audit your LLM servers, vector databases, and AI development tools. Ask: does this service require authentication? What network interfaces does it listen on? Who can modify its behavior?
Test for DNS rebinding vulnerabilities: Add DNS rebinding to your penetration testing scope. If you're running local services that accept browser-initiated requests, verify they can't be exploited through this attack vector. Tools like Singularity of Origin can help test your defenses. DNS rebinding
AI models are attack surfaces. They accept input, maintain state, and affect system behavior. Treat them like any other privileged service. The fact that it's "just" a local AI assistant doesn't mean it can run without authentication or network controls.
Start with your Ollama installations if you have them. Check the binding address, add authentication, and update to the latest version. Then expand the audit to every AI tool your team runs locally. The next DNS rebinding attack might target a different model, and you want your controls in place before researchers find it.
