LLMs could exploit inference engines to control host machines

Research indicates that large language models (LLMs) could potentially gain control of their host machines by exploiting vulnerabilities in inference engines. Because LLMs control the tokens passed to these engines, a malicious model could emit specific token sequences that an engine might mistake for executable code rather than data.

Specific vulnerabilities have been identified in software such as vLLM. For instance, CVE-2025-9141 was an arbitrary-code execution bug in vLLM’s XML-based tool parser for Qwen3 Coder. The bug allowed the LLM to execute arbitrary code on the host machine by passing tool-call arguments to the eval() function. Such attacks are particularly high-value because the host machines running frontier models often possess significant compute resources and privileged access to wider data center networks.