NVIDIA update for NemoClaw and OpenShell. Two Critical OpenShell issues — a sandbox escape and an incomplete disallowed-input list in the sandbox provisioning API → code execution + privilege escalation. Also OS command-injection and unauthenticated drive-by access to the local Ollama inference server (bound on 0.0.0.0:11434) via DNS rebinding, with persistent model poisoning.

Affected: OpenShell ≤ 0.0.33, NemoClaw (Linux) ≤ 0.0.25.

Upgrade: OpenShell → v0.0.34+, NemoClaw → v0.0.35+.

Interim: bind Ollama to loopback only (127.0.0.1:11434).