A single webpage visit can hijack and permanently poison your local AI agent
One visit to an attacker's page is enough. NVIDIA NemoClaw starts its Ollama backend bound to 0.0.0.0:11434, and DNS rebinding slips past the CORS defense so a browser can reach the unauthenticated API. From there the attacker rewrites the model's chat template, planting instructions that survive the agent's own system prompt. NVIDIA patched macOS and Linux in v0.0.35; the Windows and WSL path remains exposed.