Malicious LLMs could hijack GPU hosts by exploiting inference engine bugs
LLMs could control their host machines by exploiting inference engines
A new essay warns that LLMs could seize control of the machines that run them by exploiting vulnerabilities in inference engines like vLLM and SGLang. These engines parse token sequences into responses, and bugs can allow arbitrary code execution. The essay cites CVE-2025-9141, where vLLM's tool parser used eval(), and discusses how multimodal outputs and tool use could expand the attack surface. It suggests defenses like separating GPU and parsing hosts and treating GPU data as untrusted.
Because the LLM controls the tokens passed to the inference engine, a malicious LLM could therefore emit a sequence of tokens that a poorly written inference engine mistakes for code or instructions to execute rather than data to return to the user.