NVIDIA NemoClaw漏洞評測：Ollama本機AI遭網頁一鍵下毒 | NVIDIA NemoClaw Review: Ollama Poisoned by One Webpage

8月 26, 2026

By Kit 小克 | AI Tool Observer | 2026-08-26

🇹🇼 NVIDIA NemoClaw漏洞評測：Ollama本機AI遭網頁一鍵下毒

NVIDIA NemoClaw爆出安全漏洞：資安公司Oasis Security發現，攻擊者只要讓你打開一個惡意網頁，就能透過DNS rebinding手法，悄悄竄改你本機跑的Ollama模型的對話模板，之後你每一次對話都會被偷偷夾帶惡意指令——不用騙密碼，不用釣魚，訪客上鉤即中毒，而且中毒是永久性的，直到你重灌模型。

NemoClaw是什麼，問題出在哪

NemoClaw是NVIDIA推出的開源agent部署工具，讓開發者在OpenShell沙盒裡跑AI agent，底層常搭配Ollama做本機推理。問題出在NemoClaw預設把Ollama綁定在0.0.0.0:11434，也就是對外部網路開放，而不是只給本機用的127.0.0.1。這個設定差異，就是整起事件的根源。

DNS Rebinding怎麼一步步下毒你的模型

Oasis Security的研究員示範的攻擊鏈其實不複雜：

你瀏覽器打開攻擊者架好的網頁
網頁用DNS rebinding手法，讓你的瀏覽器把該網域先解析到攻擊者伺服器，再重新解析到127.0.0.1
瀏覽器誤判成同源請求，繞過CORS防護
攻擊者呼叫Ollama的/api/create接口，竄改模型的Go template
從此之後，你每一次對話都會被夾帶攻擊者塞的隱藏指令，而且API使用者完全看不出來

整個過程不需要偷密碼、不需要你點下載、也不需要社交工程，單純「訪問一個網頁」就中招，這也是這次NemoClaw漏洞被形容成「drive-by」攻擊的原因。

受影響範圍與修補進度

macOS / Linux：NemoClaw v0.0.35已修補（8月10日發布）
Windows / WSL：v0.0.106加了bind檢查，但WSL路徑下這個檢查不會執行，等於還是有洞
截至8月25日，Oasis Security與NVIDIA PSIRT都尚未回報有實際攻擊案例

本機跑LLM的人該做什麼

如果你用Ollama或NemoClaw跑本機模型，這幾件事現在就該做：

檢查Ollama是否綁定在0.0.0.0，改回127.0.0.1只給本機存取
把NemoClaw升到v0.0.35以上（Windows/WSL使用者要特別注意仍有殘留風險）
定期檢查模型的system template有沒有被動過手腳
不要用同一個瀏覽器session同時開來源不明的網頁和跑本機AI agent的頁面

本機跑LLM本來是為了圖個資料不出門的安心，結果預設設定反而把大門開給全世界。這次NemoClaw事件提醒大家：本機部署不等於安全部署，設定沒調好照樣能被隔空下毒。

好不好用，試了才知道

🇺🇸 NVIDIA NemoClaw Review: Ollama Poisoned by One Webpage

NVIDIA NemoClaw, the open-source stack for deploying local AI agents on top of Ollama, has a nasty vulnerability: security firm Oasis Security found that a single malicious webpage can silently rewrite your local model's chat template via DNS rebinding — no phishing, no credential theft, no download required. Just visiting a page is enough, and the poisoning persists across every future conversation.

What NemoClaw Is and Where It Breaks

NemoClaw is NVIDIA's reference deployment tool for running AI agents inside OpenShell sandboxes, commonly paired with Ollama for local inference. The root cause is simple: NemoClaw binds Ollama to 0.0.0.0:11434 by default — exposed to the network — instead of the loopback-only 127.0.0.1. That one configuration choice opens the door to everything that follows.

How DNS Rebinding Poisons Your Model

Oasis Security researchers laid out the attack chain:

You open a webpage the attacker set up
The page uses DNS rebinding to make your browser resolve the domain to the attacker's server first, then rebind it to 127.0.0.1
Your browser treats the request as same-origin, bypassing CORS protections
The attacker calls Ollama's /api/create endpoint and rewrites the model's Go template
Every conversation from then on carries hidden attacker instructions — invisible to anyone using the API normally

No stolen passwords, no downloads, no social engineering — just loading a page is enough to trigger a drive-by hijack of your NemoClaw agent.

Affected Platforms and Patch Status

macOS / Linux: fixed in NemoClaw v0.0.35 (released August 10)
Windows / WSL: v0.0.106 added a bind check, but it doesn't run on the WSL path — still exposed
As of August 25, neither Oasis Security nor NVIDIA's PSIRT has reported active exploitation

What to Do If You Run Local LLMs

Check whether Ollama is bound to 0.0.0.0; switch it back to 127.0.0.1
Update NemoClaw to v0.0.35+ (Windows/WSL users: the risk isn't fully closed yet)
Periodically check that your model's system template hasn't been tampered with
Don't browse untrusted sites in the same session where your local AI agent is running

Running LLMs locally is supposed to keep your data off someone else's server. This NemoClaw flaw is a reminder that "local" doesn't automatically mean "safe" — a bad default config can let anyone on the internet reach into your machine.

好不好用，試了才知道

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士