LLMs could control their host machines by exploiting inference engines

A critical arbitrary-code execution bug, CVE-2025-9141, was found in vLLM's XML-based tool parser for Qwen3 Coder. This vulnerability allowed LLMs to execute arbitrary code on the host machine due to the parser passing almost every tool-call argument to eval(). Despite Gemini's automatic analysis flagging it as a critical security vulnerability, the lead maintainer of vLLM force-merged the problematic PR. This highlights the need to restrict permissions for GPU hosts and treat their emitted data as untrusted.