decrypted · 27 august 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

The AI agent flaw a browser tab could exploit, and the Gitea bug already being cryptojacked

A vulnerability disclosed this week in Nvidia's NemoClaw, a wrapper for running local AI coding agents, shows what happens when convenience beats a secure default: a single visit to a booby-trapped webpage was enough to rewrite the instructions baked into a developer's AI model, permanently, with no phishing and no credentials stolen. For the UK software teams increasingly running these agents on developer laptops to keep code and prompts off third-party clouds, it is a useful reminder that a sandbox is only as good as the door left open in its wall.

What actually broke

NemoClaw runs AI coding agents, of the OpenClaw kind, inside a sandbox called OpenShell that is meant to fence off the file system, network and processes the agent can touch. To let that sandboxed agent talk to the model, which runs locally through Ollama rather than a cloud API, NemoClaw started Ollama listening on 0.0.0.0, every network interface on the machine, rather than restricting it to the loopback address only the machine itself can reach. Ollama's API had no login and no check on which website was asking.

Researchers at Oasis Security, since acquired by Cyera, found that a malicious webpage could exploit that gap with DNS rebinding, a well worn browser trick: the attacker's domain first resolves to their own server, then flips to 127.0.0.1, and the browser keeps treating the requests as coming from the same site. That was enough to reach the exposed Ollama port and call its model editing API, rewriting the chat template that sits beneath every conversation the agent has. This is not the now familiar prompt injection, which affects one exchange at a time. It edits the model's own instructions, invisibly to whoever is using it, and the change survives restarts.

The Secure by Design lesson

The flaw, tracked as CVE-2026-65105, exists because someone chose 0.0.0.0 over loopback to make container to host networking easier, and skipped the authentication that should have gone with that choice. That is precisely the trade-off Secure by Design principles exist to catch: a default that is convenient for the developer and unsafe for everyone else. Nvidia has patched NemoClaw on macOS and Linux, in version 0.0.35; as of 25 August, Windows and WSL users were still exposed. UK teams experimenting with local AI agents should check now whether their model server is bound to loopback only, and should not assume a sandbox around the agent protects the model sitting outside it.

Also this week

A critical Gitea flaw is being exploited days after joining the federal must-patch list. CISA added CVE-2026-60004, a 9.8 severity code injection bug in the self-hosted Git platform Gitea, to its Known Exploited Vulnerabilities catalogue on 25 August, giving US federal agencies until 28 August to patch. The bug lets anyone with ordinary write access to a repository, including a newly self-registered account on instances that allow open sign-up, plant a malicious patch that runs shell commands as the Gitea service account. Gitea fixed it in version 1.27.1 on 27 July, but BleepingComputer counted roughly 5,000 Gitea instances still reachable from the internet, and at least one developer has already reported a cryptomining dropper landing on their server within seconds of an automated attack. If your organisation runs Gitea for internal code hosting, this is a today job, not a this-sprint one.

A ransomware group's claim against Nottingham Trent University does not yet stand up. On 25 August, the group ShadowByt3$ posted on its leak site claiming to have breached the university on 19 August via an internet-facing web application, stealing passport and academic records. No data sample, screenshot or other evidence has been published, the university has made no statement, and researchers tracking the group describe it as low-credibility, with a history of exaggerated or fabricated claims. It is worth watching, not yet worth believing, and we will only cover it further if that changes.

Sources

Working through the Secure by Design implications for your own systems? Get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.