A pair of near-maximum-severity vulnerabilities in NVIDIA OpenShell could allow attackers to escape an AI-agent sandbox or interfere with how that sandbox is created.
Both flaws, CVE-2026-65093 and CVE-2026-65083, carry CVSS scores of 9.9 out of 10. NVIDIA says successful exploitation could lead to consequences including code execution, privilege escalation, information disclosure and data tampering.
The company has released updates for OpenShell and NemoClaw and is advising users to move to the corrected versions.
The sandbox itself is part of the risk
OpenShell is designed to isolate AI agents from the wider host system by restricting access to files, processes and networks. That makes weaknesses in the sandbox itself particularly significant, because the isolation layer is supposed to limit what an agent can reach.
NemoClaw, which runs the OpenClaw AI agent inside OpenShell, is also affected by several vulnerabilities of its own.
One of those, CVE-2026-65105, involves a NemoClaw setup using the Ollama local AI runtime. Security researchers found that the configuration could expose the local model service in a way that made a browser-based DNS rebinding attack possible.
In practical terms, visiting a malicious website could potentially allow that site to reach an AI service running on the user’s machine. Researchers demonstrated that the access could then be used to modify the model’s template and plant hidden instructions that remain active across later conversations.
Updates are already available
Keeping an agent inside a sandbox can reduce what it can directly access on a computer, but the protection is only as strong as the services, permissions and infrastructure around it.
NVIDIA has published updated versions for the affected software and recommends that NemoClaw and OpenShell users install the relevant fixes.
Leave a Reply