A Malicious Website Can Silently Hijack an NVIDIA AI Agent

This finding adds to a growing list of security issues demonstrating how easily AI agents can be transformed from useful assistants into tools for cyberattacks.

In February 2026, Oasis Security researchers discovered that a malicious website could silently take control of OpenClaw, an open-source AI agent used by developers. The vulnerability, dubbed ClawJacked, showed that attackers do not necessarily need malware or a malicious plugin to compromise an agent. In some cases, an attack does not even require any obvious action from the user.

Researchers have now discovered a similar issue in NVIDIA NemoClaw. The tool is designed to run OpenClaw inside NVIDIA OpenShell’s secure sandbox. Tracked as CVE-2026-65105, the vulnerability could give attackers control over the local AI model powering the agent if the victim opens an attacker-controlled webpage.

Following a successful compromise, an attacker could covertly alter the model’s behavior across all subsequent conversations. The user might not notice any obvious signs of interference.

This creates a fundamentally different type of threat. A compromised AI agent could become an entry point to resources far beyond a single browser tab. Researchers warn that sandboxing can limit some of the potential damage, but it does not eliminate the risk entirely when the agent has legitimate access to other systems.

AI poisoning is becoming an increasingly serious problem

The vulnerability in NemoClaw was discovered amid growing concern over so-called AI poisoning. In these attacks, threat actors do not interfere directly with the model itself. Instead, they manipulate the information consumed by the AI system.

One notable example involved DuckDuckGo’s AI service falsely reporting that Donald Trump had died of rabies. The incident demonstrated how easily AI systems can pick up fabricated claims when attackers deliberately contaminate the sources on which they rely.

Security researchers are also increasingly discovering malicious instructions hidden on websites and aimed at AI agents. After visiting such a page, an agent may receive instructions to ignore its original task, disclose confidential information, or perform an action that benefits the attacker.

The NemoClaw vulnerability makes this problem even more dangerous because the attack targets the local AI infrastructure powering the agent. NemoClaw can use Ollama, a platform that allows large language models to run directly on a user’s own hardware.

Running AI locally gives users greater control over their data and can improve privacy. At the same time, it removes many of the centralized security safeguards provided by services such as OpenAI, Google, and Anthropic.

This is precisely why the NemoClaw vulnerability poses a serious threat. Researchers have previously warned that cybercriminals could exploit the absence of centralized protections to hijack computers running open-source AI models outside the security guardrails of major AI platforms.