NemoClaw flaw puts local agents on notice

NVIDIA’s NemoClaw agent deployment tool has a vulnerability tracked as CVE-2026-65105 that can let a malicious webpage compromise the local model server and persist hidden instructions, according to Cyera’s security disclosure. The governance lesson is larger than the bug: a sandbox limits the endpoint, but an agent’s real blast radius is the code, tools, and organizational systems its credentials can reach. Teams giving agents write access should pair local-model isolation with approval and logging, the same discipline the archive recommends for Claude’s Gmail and Drive actions.