NVIDIA Patches High-Severity NemoClaw Flaw After Model-Poisoning Demo

NVIDIA just patched NemoClaw (CVE-2026-65105), a high-severity flaw in NeMo that researchers exploited via DNS rebinding to poison a model running through Ollama. The nasty part: the poisoning is persistent. Once the attack closes, the model keeps behaving maliciously through normal restarts. The initial vector is gone. The model is still compromised.

Standard uptime and availability monitoring sees nothing wrong. The service is up. Requests are returning. Latency is fine. The only thing that changed is what the model actually does — and nothing in a typical observability stack is watching for that.

This creates a gap that's easy to miss in threat models: you can detect that an attack happened, you can patch the vulnerability, and you can confirm the service is running — and still have a poisoned model in production answering real user queries.

For those running self-hosted inference (Ollama, vLLM, local NeMo deployments): how are you detecting behavioral drift after a security incident like this? Are you doing any output sampling or behavioral baselining, or is your detection basically 'someone notices something weird'?