Disclosed vulnerability
Ollama desktop: model output rendered as HTML lets an injected website overwrite the whole UI for phishing, plus zero-click markdown exfiltration
AIR-2026-0123 AIR record · 2026-05-ollama-desktop-overlay-and-exfil
From the supporting source
The entire Ollama desktop interface can be overwritten by an attacker-controlled website via an indirect prompt-injection attack due to insecure rendering of model outputs.promptarmor.com
The record
Disclosed
2026-05-28
Vendor
Ollama
Product
Ollama desktop application
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — Ollama rendered attacker HTML and fetched the exfiltration image
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection web content
Impact type
Credential theft, Data exfiltration, Ui spoofing
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Ollama desktop users with web search enabled
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
unpatched; Ollama did not respond to five contacts
Taxonomy & references
Curator notes
PromptArmor. Reported 2025-12-18, no response after four follow-ups, publicly disclosed 2026-05-28. 'No human-in-the-loop approval steps are required for any attacks in this article.' Local-model deployments are not a defense against this class.
Supporting sources
Cite as
Enkrypt AI. "Ollama desktop: model output rendered as HTML lets an injected website overwrite the whole UI for phishing, plus zero-click markdown exfiltration". AIR, AIR-2026-0123. https://agentincident.vercel.app/i/AIR-2026-0123/ (accessed 2026-10-19).