Nvidia's agent sandbox holds; the model server underneath it answers to any browser tab

Ollama's API has no authentication. In place of it there are two middleware checks: an origin allowlist and validation of the Host header ^[5]. NemoClaw disables one of them by its own hand. The Host check is skipped whenever the bind address is not loopback ^[5], and NemoClaw starts Ollama with `OLLAMA_HOST=0.0.0.0:11434` ^[16]. That leaves the origin allowlist, which DNS rebinding walks around: a domain the attacker controls serves the victim a page on port 11434, then re-resolves to 127.0.0.1, and the browser raises no objection because same-origin policy keys on the hostname rather than the address behind it ^[6]. Two substitutes for authentication, one removed by configuration and one bypassed by a decade-old browser technique, come to zero controls in front of the API ^[15].

The reason NemoClaw binds that way is mundane. Docker containers have no route to 127.0.0.1, where Ollama binds by default ^[16], so the sandboxed agent needs the server on an interface it can see. The OpenShell sandbox fences off the file system, the network and the processes the agent can touch ^[3]; the model server it depends on sits outside that fence. Elad Luz, head of research at Oasis, said the blast radius of an AI system is its authorizations rather than its isolation ^[12]. Randolph Barr, CISO at Cequence Security, put it as plumbing: sandboxing the agent buys little if the thing it is built on is reachable from any tab ^[14].

The escalation from access to poisoning is the part worth reading twice. Injecting a hidden system prompt fails, because OpenClaw sends its own and overrides it ^[8]. So the researchers went below the prompt. Ollama's `/api/create` accepts a template field, a Go template that renders the message list into the raw text the model actually reads; an attacker pulls the existing template through `/api/show`, splices in an instruction and writes it back ^[9]. From then on every message passes through the attacker's version, including the agent's system prompt, which arrives at the model with the hidden instruction appended ^[10]. Oasis says an instruction in that position can tell the agent to write vulnerabilities that pass casual review, to keep quiet about security problems, or to push conversation contents to an outside endpoint ^[11].

Nothing about the model looks wrong afterwards. Name, size and metadata read as normal, and opening a fresh chat clears nothing, because the payload lives in the model definition rather than in conversation state an operator can reset ^[10]. The same access would also let an attacker delete models outright ^[7], which is loud. This is quiet. Oasis reported the flaw to Nvidia's PSIRT before publishing and released a video walking the chain from malicious website to a poisoned agent answering with the attacker's marker ^[2][13].

One detail deserves separate mention: with port 11434 live on every interface, other devices on the same network segment can reach it too, and the install message still reads `localhost:11434` ^[16]. An operator checking that line has no reason to think the server is anywhere but the loopback.