// HACKER NEWS — CYBERSECURITY
LLMs could control their host machines by exploiting inference engines
Large language models often take actions running on one computer (via an
agentic harness such as Claude Code or Codex), however the LLMs’ responses to
prompts are computed on a different computer with GPU access. Could a malicious
LLM gain control of the host machine where its weights are loaded? Such a
machine is a high-value target: it has sufficient compute to run a frontier
LLM, offers easy access to the LLM’s weights, and has privileged access to
other computers in the datacentre compared with a generic computer on the
internet.
This essay explores how easily a malicious LLM could take control of the host
machine. The primary attack considered here involves the LLM emitting a token
sequence whose semantic meaning is irrelevant but that exploits a vulnerability
in the software that loads an LLM onto GPUs, runs the LLM to generate output
tokens, and parses those tokens into responses. .
Like any program, inference engines like vLLM or SGLang may contain
exploitable bugs. Because the LLM controls the tokens passed to the inference
engine, a malicious LLM could therefore emit a sequence of tokens that a poorly
written inference engine mistakes for code or instructions to execute rather
than data to return to the user.
But surely all inference engines are robust pieces of software and this would
never happen, right?
CVE-2025-9141 was an arbitrary-code execution bug in vLLM’s XML-based tool
parser for Qwen3 Coder. The parser passed almost every tool-call argument to
eval(), allowing the LLM to execute arbitrary code on the host machine.
Gemini automatically analysed the PR that introduced this bug and
correctly flagged it as a critical security vulnerability. Despite that
warning, the lead maintainer of vLLM force-merged the PR, writing:
Unfortunately, parsing an arbitrary token sequence into a fully fledged chat
(with user turns, assistant responses, tool calls, and so on) is not trivial,
and the exact process often differs between LLMs. This complexity creates more
opportunities for bugs that could permit arbitrary code execution on the host
machine.
Modern inference engines do more than map token sequences to strings. vLLM’s
documentation lists support for more than 200 model architectures, and its
examples directory contains about 35 Jinja chat templates. Modern
inference engines parse many chat formats, and slightly misspecified parsing
logic result in an LLM’s output being interpreted as code to execute.
In this vLLM issue, a user was discussing how LLMs reason with MiniMax-M3,
and the LLM emitted the string . vLLM mistakenly parsed this plain
string as the start of a reasoning block. So instead of:
Response: I'll echo exactly what you said: \nThere, how was that?
This is a fairly harmless parser bug, but it demonstrates that inference
engines do more than convert tokens to strings and concatenate them. They are
complex systems under constant iteration and their developers are under a lot
of pressure to make them as fast as possible. These factors increase the risk
that a malicious LLM could turn a parser bug into arbitrary code execution on
the inference host.