Researchers disclosed a flaw in NVIDIA NemoClaw, a stack for running AI agents like OpenClaw with local inference through Ollama, that lets a single malicious webpage hijack the agent. Tracked as CVE-2026-65105, the issue is that NemoClaw starts Ollama bound to all network interfaces, so a DNS-rebinding attack from a page the user simply visits reaches the local model server and takes unauthenticated control. The attacker can then rewrite the model's chat template to plant hidden instructions that run on every later inference, beneath the agent's own guardrails and persisting across conversations. A fix landed in version 0.0.35 for macOS and Linux, but the Windows path remains exposed.
CISA added a critical flaw in Ray, the open-source framework for scaling AI and machine-learning workloads, to its exploited-vulnerabilities catalog and gave federal agencies just three days to fix it. Tracked as CVE-2025-62593 and scored 9.4, the bug stems from Ray leaving key dashboard and job endpoints unauthenticated; its only browser defense checked that the request's user-agent began with Mozilla, which attackers can forge. Combined with a DNS rebinding attack, a malicious website or advertisement viewed while running Ray can execute code on the developer's machine. A DDoS botnet adopted it before public disclosure, and a separate campaign has been turning unpatched Ray clusters with GPUs into cryptocurrency miners.
TrustStrike Labs