Your AI agent can be hijacked just by visiting a website
Your AI agent is the new attack surface.
Man working on laptop San Francisco, California. By Smith Collection/Gado/Getty Images
- A malicious website can exploit NVIDIA NemoClaw to take over the local AI model behind an agent.
- Attackers could change an agent’s future responses while remaining hidden from the user.
- Sandboxing can reduce damage, but agents may still reach other systems they can legitimately access.
- The flaw adds to concerns about attackers poisoning websites and local AI systems with hidden instructions.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A critical vulnerability in NVIDIA NemoClaw could let attackers hijack an AI agent after a victim visits a malicious website.
The finding adds to a growing list of security problems showing how easily AI agents can cross the line from useful assistants to attack tools.
In February 2026, Oasis Security found that a malicious website could silently take control of OpenClaw, an open-source agent used by developers. The flaw, dubbed ClawJacked, showed that an attacker did not necessarily need malware, a malicious plugin or even an obvious user action to compromise an agent.
Now, its researchers have found a similar flaw in NVIDIA's NemoClaw, a tool designed to run OpenClaw inside NVIDIA's OpenShell security sandbox. The vulnerability, tracked as CVE-2026-65105, can give attackers control of the local AI model serving the agent after the victim visits an attacker-controlled webpage.
Once compromised, the attacker can alter the model's behavior across all subsequent conversations, while staying hidden from the user.
That creates a very different kind of security problem. A compromised agent could become a stepping stone into resources far beyond the browser tab. The researchers warn that sandboxing can limit some damage, but it does not eliminate the risk when an agent has legitimate access to other systems.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
AI poisoning is becoming a bigger problem
The NemoClaw finding also lands amid a growing concern over AI poisoning, with attackers manipulating the information that AI systems consume, rather than attacking the models directly.
In one striking example, DuckDuckGo AI falsely reported that Donald Trump had died of rabies. The incident showed how easily AI systems can pick up fabricated material when attackers deliberately contaminate the information they rely on.
Security researchers are increasingly finding malicious instructions hidden on websites for AI agents. An agent visiting one of these pages could encounter instructions telling it to ignore its original task, reveal information or take an action that benefits the attacker.
The NemoClaw flaw takes that problem a step further, targeting the local AI infrastructure underneath the agent. NemoClaw can use Ollama, a platform that lets users run large language models locally on their own hardware.
While local AI offers greater control and privacy, it also removes much of the centralized safeguards that come with services such as those by OpenAI, Google and Anthropic.
This makes the NemoClaw flaw significant, as security researchers have already warned that criminals can exploit this gap to commandeer computers running open-source AI models outside the guardrails of major AI platforms.
