Boyd Kane: a malicious open-weight LLM could take over its host by emitting tokens that exploit the inference engine
In an essay published August 25, Boyd Kane argues the token stream itself is an unguarded attack surface: an LLM can emit a sequence whose semantics are irrelevant but which triggers a parser bug in vLLM or SGLang, giving it code execution on a box that holds its own weights and has datacentre network access. He anchors it in CVE-2025-9141, where vLLM's XML tool parser for Qwen3 Coder passed nearly every tool-call argument to eval(), and notes the lead maintainer force-merged the PR despite Gemini's automated review flagging it critical. His proposed defense is architectural, split GPU execution from token parsing onto different machines and strip the host's permissions, which is directly actionable for anyone self-hosting open weights.
↳ Follow the thread