2026-11-04 · Fonte：deep-siliconangle.com/feed/?paged=8
Oasis Security researchers disclosed CVE-2026-65105, a NemoClaw flaw triggered by one visit to a malicious website that hands attackers full control of the model server behind a developer's AI agent.
Researchers at Oasis Security Ltd., a nonhuman identity security company, have disclosed a vulnerability in Nvidia Corp.'s NemoClaw that hands an attacker full control of the local model server powering a developer's AI agent. The flaw is tracked as CVE-2026-65105. The disclosure was published today, Aug. 25, 2026, and centers on the server component that runs the model behind an agent in a developer's local environment.
What makes the flaw notable is its trigger: a single visit to a malicious website is enough to set the attack in motion. Loading an attacker-controlled page is all it takes, per the disclosure, to open a path to taking over the model server. Once an attacker has full control of that server, the model behind a developer's AI agent can be poisoned, corrupting the foundation the agent relies on.
The disclosure also carries a signal about where AI infrastructure risk is heading. Oasis Security specializes in nonhuman identity security, a field concerned with the machine-side actors — services, servers and automated agents — rather than human credentials. Viewed through that lens, a model-server takeover triggered by ordinary web browsing illustrates how the components developers use to run AI agents locally have become attack surface in their own right.
Oasis reported the vulnerability to Nvidia's Product Security team, the standard vendor channel for flaws of this kind. NemoClaw is Nvidia's offering in the agentic AI tooling space, and the local model server it involves is the component that actually executes the model a developer's agent depends on. That positioning is what gives the bug its weight: whoever controls the server controls the model, and with it, the behavior of the agent built on top.
Tags: Nvidia · NemoClaw · Oasis Security · CVE-2026-65105 · AI Security · Model Poisoning
萬安算交所 AIXX · AIXX · Exchange verificado · Ir ao mercado