Large language models often run on separate machines from their inference engines, but a malicious LLM could potentially control the host machine where its weights are loaded. This high-value target offers significant compute and privileged access to other computers in the datacentre.

The primary attack vector involves the LLM emitting token sequences that exploit vulnerabilities in software loading the model. Like any program, inference engines like v LLM or SGLang may contain exploitable bugs. A malicious LLM could emit tokens mistaken for executable code rather than user responses.

For instance, CVE-2025-9141 was an arbitrary-code execution bug in v LLM’s XML-based tool parser for Qwen3 Coder. The parser passed arguments to eval(), allowing code execution. Despite Gemini flagging the issue as critical, the lead maintainer force-merged the PR due to parsing complexity.

These engines are complex systems supporting over 200 model architectures. Bugs are common; one issue showed v LLM misparsing `<mm:think>` from Mini Max-M3 as reasoning text. While multimodal outputs add attack surfaces, current constrained media tokens limit direct file exploits.