The AI Sandbox Was the Attack Surface: NVIDIA Fixed 18 NemoClaw and OpenShell Flaws.
NVIDIA has fixed 18 vulnerabilities across NemoClaw and OpenShell, including two critical OpenShell flaws that score 9.9 and can turn an AI-agent sandbox into a path for code execution and privilege escalation.
The 25 August 2026 security bulletin is unusually consequential because the highest-severity defects sit in the isolation layer itself. One is a network-reachable sandbox escape. The other is an incomplete deny list in the sandbox-provisioning API. Both require low privileges, require no user interaction and cross a security boundary.
NVIDIA’s page was updated at 09:57 AM on 25 August, but it does not specify a timezone. The revision history lists the same date for the initial release and provides no time.
Two critical flaws undermine the sandbox
CVE-2026-65093 is a sandbox escape in OpenShell. A network attacker with low privileges can exploit it without user interaction, potentially executing code, escalating privileges, altering data and disclosing information outside the intended containment boundary.
CVE-2026-65083 affects the sandbox-provisioning API. NVIDIA describes an incomplete list of disallowed inputs that can produce the same code-execution and privilege-escalation impact, with denial of service added to the possible outcomes.
Both score 9.9 under CVSS 3.1. OpenShell versions through 0.0.33 are affected, and version 0.0.34 contains the fixes.
The practical lesson is broader than the two CVSS scores. AI-agent platforms deliberately connect models to tools, credentials, networks and execution environments. The sandbox is the control expected to limit a compromised or manipulated agent. A remotely reachable defect in that control deserves the same urgency as a boundary failure in other orchestration infrastructure.
Every vulnerability in the bulletin
NVIDIA has not reported active exploitation, observed scanning or a public proof of concept for any of the 18 vulnerabilities. The bulletin provides no alternate workaround. The supported remediation is to update to the listed OpenShell release or NemoClaw commit.
| Vulnerability | Impact and prerequisites | Affected and fixed versions | Exposure status |
|---|---|---|---|
| CVE-2026-65093, critical 9.9 | OpenShell sandbox escape. Network access and low privileges are required; no user interaction. Code execution, privilege escalation, tampering and disclosure. | OpenShell 0 through 0.0.33; fixed in 0.0.34. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65083, critical 9.9 | Incomplete disallowed-input list in the OpenShell sandbox-provisioning API. Network access and low privileges; no user interaction. Code execution, privilege escalation, tampering, disclosure and denial of service. | OpenShell 0 through 0.0.33; fixed in 0.0.34. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65091, high 8.8 | A malicious OpenShell gateway can cause OS command injection. Network reachable without privileges, but user interaction is required. Code execution, tampering and disclosure. | OpenShell 0 through 0.0.33; fixed in 0.0.34. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65092, high 8.5 | Path traversal bypasses OpenShell Sandbox’s Layer 7 REST network policy. Network access and low privileges; no user interaction. Disclosure and tampering. | OpenShell 0 through 0.0.33; fixed in 0.0.34. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65098, high 8.1 | Weak authentication in NemoClaw’s remote-access helper. Remote and unauthenticated, with high attack complexity and no user interaction. Code execution, disclosure and tampering. | NVIDIA lists 0 through 0.0.4; fixed by commit 5864d9751 at 0.0.4. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65081, high 8.1 | NemoClaw installation can execute untrusted code. Remote and unauthenticated, with high complexity and no user interaction. Code execution, privilege escalation, tampering, disclosure and denial of service. | NVIDIA lists 0 through 0.0.21; fixed by commit 11af5fdac at 0.0.21. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65084, high 8.1 | Improper certificate validation during NemoClaw deployment. Remote and unauthenticated, with high complexity and no user interaction. Code execution, privilege escalation, tampering and disclosure. | NVIDIA lists 0 through 0.0.1; fixed by commit b7c254114 at 0.0.1. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65105, high 8.1 | An adjacent-network attacker can reach NemoClaw’s inference service without authentication. No user interaction. Disclosure and denial of service. | NVIDIA lists 0 through 0.0.25; fixed by commit f06796ff3 at 0.0.25. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65096, high 7.8 | OS command injection in the NemoClaw Telegram bridge. Local access and low privileges; no user interaction. Code execution, privilege escalation, tampering and disclosure. | NVIDIA lists 0 through 0.0.1; fixed by commit 156c9a201 at 0.0.1. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65099, high 7.8 | OS command injection in the NemoClaw command-line interface. Local access and low privileges; no user interaction. Code execution, tampering, disclosure and denial of service. | NVIDIA lists 0 through 0.0.1; fixed by commit 156c9a201 at 0.0.1. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65090, high 7.8 | OS command injection in NemoClaw NIM management. Local access and low privileges; no user interaction. Code execution, tampering, disclosure and denial of service. | NVIDIA lists 0 through 0.0.17; fixed by commit 7983fc7d1 at 0.0.17. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65089, high 7.8 | OS command injection in NemoClaw status and logs plugin commands. Local access and low privileges; no user interaction. Code execution, tampering, disclosure and denial of service. | NVIDIA lists 0 through 0.0.3; fixed by commit 800195b55 at 0.0.3. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65097, high 7.5 | NemoClaw installation scripts download code without an integrity check. Remote and unauthenticated, with high complexity and user interaction. Code execution, privilege escalation, tampering and disclosure. | NVIDIA lists 0 through 0.0.21; fixed by commit 48c0d54d4 at 0.0.21. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65082, high 7.0 | Code injection in the NemoClaw migration command. Local access, low privileges and high complexity; no user interaction. Code execution, tampering, disclosure and denial of service. | NVIDIA lists 0 through 0.0.17; fixed by commit 7983fc7d1 at 0.0.17. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65086, medium 6.8 | OS command injection in the OpenShell sandbox exec handler. Network access, low privileges and high complexity; no user interaction. Code execution, disclosure and tampering. | OpenShell 0 through 0.0.33; fixed in 0.0.34. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65087, medium 5.6 | Insufficiently protected NemoClaw credentials. Local access, low privileges and user interaction. Disclosure and limited tampering. | NVIDIA lists 0 through 0.0.1; fixed by commit a46160697 at 0.0.1. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65088, medium 5.5 | Sensitive information is exposed through visible process invocation. Local access and low privileges; no user interaction. Information disclosure. | NVIDIA lists 0 through 0.0.17; fixed by commit 7983fc7d1 at 0.0.17. | No alternate workaround, no public PoC and no confirmed exploitation. |
| CVE-2026-65085, medium 5.2 | Improper output encoding or escaping in the OpenShell inference proxy. Local access and low privileges; no user interaction. Disclosure and tampering across a changed scope. | OpenShell 0 through 0.0.33; fixed in 0.0.34. | No alternate workaround, no public PoC and no confirmed exploitation. |
The NemoClaw version numbers need careful reading
Several NemoClaw rows list the same semantic version at the end of the affected range and in the updated-version column. The differentiator is the fixed Git commit, not the visible version number alone. An installation that reports 0.0.21, for example, is not necessarily fixed unless it contains the relevant patched commit.
Administrators should update directly from NVIDIA’s official NemoClaw repository and verify the installed commit against the bulletin. OpenShell guidance is simpler: move to 0.0.34 or later.
What defenders should prioritise
- Update OpenShell to 0.0.34 or later before exposing any provisioning or gateway interface.
- Update NemoClaw from NVIDIA’s official repository and verify the commit, not just the semantic version.
- Rotate credentials that may have been exposed through process listings or weak storage.
- Review network reachability to sandbox provisioning, gateways, inference services and remote-helper components.
- Inspect logs for unusual sandbox creation, policy bypasses, shell execution and inference-service access.
There is no evidence that attackers are exploiting these issues. That distinction matters. The 9.9 scores are vendor risk assessments, not confirmation of malicious activity, and no public exploit has been identified.
Even so, the bulletin changes defender urgency. The most serious flaws are reachable across a network and break the component intended to contain an agent. For teams experimenting with agentic AI, sandboxing cannot be a one-time architecture decision. The sandbox itself needs patching, isolation, authentication and monitoring as a high-value execution boundary.
Source: NVIDIA Security Bulletin: NemoClaw and OpenShell, August 2026. Updated 25 August 2026 at 09:57 AM, timezone not specified. Initial release dated 25 August 2026, no publication time provided in the revision history.
