GoKawiilvLLM tool-parser bug let AI-generated text trigger code execution
Researchers documented that vLLM's XML-based tool parser for Qwen3 Coder (CVE-2025-9141) fed model-generated arguments directly into Python's eval() function, meaning a language model's own output tokens could execute arbitrary code on the machine running it. A Gemini-based review flagged the change as a critical risk before it was merged, but the lead vLLM maintainer force-merged it anyway.
GoKawiil's interpretation of the reporting above, not reported fact.
Inference servers are treated as trusted infrastructure with access to GPU weights and privileged datacenter networks, so a parsing flaw like this turns the model's text output into a potential remote-code-execution channel. It shows that AI safety risk isn't only about model behavior—it's also about the mundane software plumbing (parsers, eval calls) that turns tokens into actions, and that maintainers can dismiss such warnings under deadline pressure.
- CVE-2025-9141 shows an LLM's own generated tokens could execute arbitrary code via vLLM's tool parser.
- An automated security review (Gemini) correctly flagged the risky eval() usage before the fix shipped.
- The vulnerability was merged anyway despite the warning, highlighting weak review practices in widely used inference engines.
NVIDIA GeForce RTX 4090 Founders Edition — If you want to actually run vLLM or SGLang locally and poke at inference engines yourself, a high-VRAM GPU like the RTX 4090 is the workhorse that makes hosting sizable open-weight models feasible on your own machine. Running inference on hardware you control is also the cleanest way to experiment with the kind of engine-level behavior this essay dissects.
See NVIDIA GeForce RTX 4090 Founders Edition on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: boydkane.com, 2026-08-24
Published there as: “LLMs could control their host machines by exploiting inference engines”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.