A vLLM Maintainer Force-Merged a Tool Parser That Called eval() on Model Output After Gemini Flagged It as Critical

Boyd Kane (boydkane.com), also on LessWrong and Hacker News item 49424387·high signalXBlueskyLinkedInCopy link

Boyd Kane's essay, published 2026-08-25, argues the inference engine is the shortest path from a model's output tokens to code execution on the GPU host, and cites CVE-2025-9141 as the proof: vLLM's XML tool parser for Qwen3 Coder passed nearly every tool-call argument to eval(). Gemini reviewed the pull request that introduced the bug and correctly flagged it as a critical vulnerability, and the lead maintainer force-merged it anyway. The host in question holds the weights and has privileged datacenter network access, which makes it a much better target than whatever machine the agent harness runs on.