AI models vulnerable to poisoning through malicious web pages

The Hacker News reports that security researchers at Oasis Security have disclosed a vulnerability in NVIDIA NemoClaw that allows attacker-controlled web pages to take unauthenticated control of local Ollama instances serving AI agents and plant hidden instructions directly inside the model itself. The weakness stems from how NemoClaw handles networking when connecting to local AI model servers. An attacker who can get a user to visit a malicious webpage could exploit this to inject persistent instructions into the AI model that would affect all subsequent interactions, effectively poisoning the model's behaviour without the user's knowledge. Separately, Dark Reading reports that researchers have demonstrated how hidden HTML prompts invisible to users can manipulate AI-powered email summarisers into producing false or malicious summaries of email content.

Why this matters for UK organisations

AI agents and AI-assisted tools are rapidly being integrated into business workflows across UK organisations, from email summarisation and document analysis to customer service, internal knowledge management and software development. Many of these tools run locally or connect to local model servers, and the assumption has been that local deployment provides better security control than cloud-based AI services. These findings challenge that assumption by showing that local AI infrastructure can be compromised through relatively simple web-based attacks. For organisations deploying AI coding assistants, AI-powered productivity tools or autonomous AI agents, the risk is not just data leakage but model corruption that could persist across sessions and affect decision-making, code generation or business logic without obvious signs of compromise. The poisoned instructions could be designed to introduce subtle errors, bypass security checks, leak sensitive information or manipulate business processes in ways that are difficult to detect through normal testing or code review.

What to review

UK organisations exploring or deploying AI tools should review how AI agents and local models are networked, what authentication controls are in place, and whether AI-generated content is being validated before it influences business decisions. Consider whether your AI tools have unauthenticated network access to local services, whether they can be reached from web browsers or other applications, and whether you have monitoring in place to detect unusual model behaviour or unexpected network connections. For organisations using AI coding assistants, review whether code generated by AI tools is subject to the same security review and testing processes as human-written code. For organisations using AI-powered email tools, consider whether email summaries are being used to make business decisions without users reading the original content, and whether there are controls to detect manipulation of AI-generated summaries. The broader lesson is that AI tools should be treated as part of your attack surface, not as passive productivity aids, and that the security controls around AI deployment need to mature as quickly as the technology itself.

Source: The Hacker News