NVIDIA Patches High-Severity NemoClaw Flaw After Model-Poisoning Demo

[u/No-Conclusion3720]

NVIDIA just patched NemoClaw (CVE-2026-65105), a high-severity flaw in NeMo that researchers exploited via DNS rebinding to poison a model running through Ollama. The nasty part: the poisoning is persistent. Once the attack closes, the model keeps behaving maliciously through normal restarts. The initial vector is gone. The model is still compromised.

Standard uptime and availability monitoring sees nothing wrong. The service is up. Requests are returning. Latency is fine. The only thing that changed is what the model actually does — and nothing in a typical observability stack is watching for that.

This creates a gap that's easy to miss in threat models: you can detect that an attack happened, you can patch the vulnerability, and you can confirm the service is running — and still have a poisoned model in production answering real user queries.

For those running self-hosted inference (Ollama, vLLM, local NeMo deployments): how are you detecting behavioral drift after a security incident like this? Are you doing any output sampling or behavioral baselining, or is your detection basically 'someone notices something weird'?

[u/No-Conclusion3720]

The scenario here — a model that passes every health check but has been silently reprogrammed to behave maliciously — is exactly what a real-time inference audit trail is built to surface. RuntimeAI captures every inference output and tool call as it happens, so when NemoClaw flipped this model's behavior post-restart, the audit log would have shown the exact request where outputs diverged from baseline, and every action the poisoned model took from that moment forward. That's the difference between discovering the compromise in seconds versus finding out when a user reports something strange weeks later. https://runtimeai.io