Summary
The researchers said a malicious webpage can use DNS rebinding to reach the local Ollama API without credentials. They reported that an attacker can change the model’s chat template, allowing hidden instructions to persist across later agent conversations.
Why it matters
The finding breaks the assumption that a browser page and a local agent backend are separate trust domains. It makes browser exposure, local model integrity and agent sandboxing distinct controls for developer tooling.
Related coverage
- TRACE proposes a portable evidence standard for AI-agent runtimes
- AC2 launches an open protocol for user-approved agent actions
- Nucleus Helix combines vulnerability intelligence with agentic exposure workflows