LLM Can Control Host Machine by Exploiting Inference Engine Vulnerabilities

LLMs operate with a separation between GPU servers that compute prompt responses and agent harnesses that perform actual tasks. A malicious LLM can exploit software vulnerabilities in the inference engine to control the host machine where its weights are loaded, which means gaining privileged access to other computers within the data center.

Inference engines such as vLLM and SGLang are prone to bugs during the process of parsing token sequences. In particular, CVE-2025-9141 was a critical vulnerability in vLLM's XML-based tool parser that was designed to pass Qwen3 Coder's tool call arguments to the eval() function. This allowed the LLM to execute arbitrary code on the host machine, and it was revealed that a key maintainer force-merged a PR containing the bug despite security warnings.

Modern inference engines support over 200 model architectures and various chat templates, going beyond simple string mapping. Due to this complexity, there is a high possibility that LLM output may be misinterpreted as executable code or commands rather than data, and the risk of arbitrary code execution attacks on the host machine persists.