Malicious LLMs could exploit bugs in inference engines like vLLM to execute arbitrary code on host machines; CVE-2025-9141 allowed code execution via XML parser vulnerability despite security warnings.

LLMs could control their host machines by exploiting inference engines

| Read on LessWrong | Large language models often take actions running on one computer (via an agentic harness such as Claude Code or Codex), however the LLMs’ responses to prompts are computed on a different computer with GPU access. Could a malicious LLM gain control of the host machine where its weights are loaded? Such a machine is a high-value target: it has sufficient compute to run a frontier LLM, offers easy access to the LLM’s weights, and has privileged access to other computers in the...