NVIDIA NemoClaw Vulnerability Allows Webpage to Poison Local AI Models

Researchers at Oasis Security have uncovered a critical vulnerability within NVIDIA's NemoClaw component that could allow attackers to compromise local AI model instances. The exploitchain begins with a specially crafted malicious webpage. When a user interacts with this page, it can leverage the NemoClaw vulnerability to gain unauthorized access to a local Ollama instance, which is commonly used to serve AI models.

Once control of the Ollama instance is established, an attacker can inject hidden instructions directly into the AI model. This process, known as model poisoning, can subtly alter the AI's behavior, leading it to generate biased, incorrect, or malicious outputs in the future. The unauthenticated nature of the exploit is particularly concerning, as it lowers the barrier to entry for attackers and requires no prior compromise of the target system beyond the user visiting a malicious site.

The vulnerability specifically targets the interaction between web interfaces and local AI model serving frameworks like Ollama. NemoClaw, a component often used in AI development workflows, appears to have a weakness that permits this unauthorized command execution. This could have significant implications for developers and organizations relying on local AI models for sensitive tasks, as the integrity of the model's responses could be compromised.

Oasis Security has responsibly disclosed their findings to NVIDIA's Product Security Incident Response Team (PSIRT), initiating the process for a potential fix. The exact scope of affected NemoClaw versions and Ollama configurations is still under investigation, but the potential for widespread impact is clear given the growing adoption of local AI deployments for privacy and performance reasons.

This discovery highlights a new attack vector targeting the AI supply chain and the integrity of machine learning models. As AI becomes more integrated into critical infrastructure and daily workflows, securing the components that manage and serve these models is paramount. The ability to poison a model remotely via a webpage underscores the need for robust security practices in AI development and deployment.

Users and organizations employing local AI models served through Ollama, especially those interacting with web-based interfaces or potentially untrusted web content, should exercise caution. While NVIDIA works on a patch, understanding the potential for model poisoning is the first step in mitigating this emerging threat. Further details are expected following NVIDIA's official advisory and patch release.