DRIVE-BY AGENT HIJACKING: ONE WEBSITE VISIT, PERSISTENT MODEL POISONING

Summary from the TLDR InfoSec newsletter

Cyera disclosed CVE-2026-65105 in NVIDIA NemoClaw. NemoClaw's setup binds Ollama to 0.0.0.0:11434, disabling Ollama's Host-header validation, allowing for an attacker-controlled site to use DNS rebinding to reach the victim's local Ollama API without authentication. The attacker can list models, extract templates and prompts, delete or overwrite models, consume GPU resources, and sign users out. By modifying a model's chat template, the attacker can append hidden instructions to every future system prompt.