The Model Is On Your Machine
Boyd Kane's essay argues that inference engines — complex parsing stacks supporting hundreds of model architectures — represent an underappreciated attack surface where a malicious model's output could be mistaken for code to execute. CVE-2025-9141 in vLLM, which passed Qwen3 Coder tool-call arguments directly to eval(), shows this isn't theoretical.
Read more →