Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-25 · high
The flawed code ran on the host holding the model weights, with privileged access to the rest of the datacenter network.
Why now: Boyd Kane published the essay and CVE-2025-9141 analysis on August 25.
A vLLM maintainer force-merged a tool parser that ran eval() on model output, overriding a critical flag from Gemini's automated review, per Boyd Kane's essay on inference engine security.
The host running that parser holds the model's weights and sits inside the datacenter network with privileged access. Kane argues that makes it a far better target for an attacker than whatever laptop happens to be running an agent script.
CVE-2025-9141 names the flaw. vLLM's XML tool parser for Qwen3 Coder passed nearly every tool-call argument straight into Python's eval(). That turned a model's own output into code the host would execute.
Kane's proposed fix doesn't patch that one parser. It splits GPU execution from token parsing onto separate machines, and strips the inference host of permissions it doesn't need just to serve tokens. That way a bad parser can't reach the weights or the network the GPU box sits on.
Each link below shares sources, entities, or timing with this story.
Claude Code benchmarked against Gemini / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code benchmarked against Gemini); both cover CVE, Gemini; overlapping topics (access, agent, model, review, tool).
Copilot deprecates Gemini / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Copilot deprecates Gemini); both cover CVE, Gemini; overlapping topics (access, agent, tool).
Vercel uses Gemini / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Vercel uses Gemini); both cover August, Gemini; overlapping topics (agent, model).
Google Search uses Gemini / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Google Search uses Gemini); both cover August, Gemini; overlapping topics (model, tool).
Gemini competes with Claude / Shared entity: August / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Gemini competes with Claude); both cover August; overlapping topics (agent, token, tool).
Claude Code benchmarked against Gemini / Shared entity: August / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code benchmarked against Gemini); both cover August; overlapping topics (agent, model, token, tool).
Linked by a graph relationship (Claude Code benchmarked against Gemini); both cover August; overlapping topics (agent, model, token, tool).
Copilot deprecates Gemini / Shared entity: Gemini / Shared topic / Earlier coverage
Linked by a graph relationship (Copilot deprecates Gemini); both cover Gemini; overlapping topics (agent, output, token, tool).