CPython flaw exposes AI inference servers to sandbox escape attacks

Summary

RunSybil researchers report a memory-safety flaw in CPython that lets a malicious AI model's chat_template.jinja escape the Jinja sandbox and execute arbitrary code in inference servers such as vLLM. They demonstrated it with a backdoored Qwen2.5-0.5B-Instruct model and shared proof-of-concept exploits with inference providers offering bring-your-own-model features. The Python Security Response Team disputes that the demonstrated sandbox escape is a CPython vulnerability, saying untrusted code execution inside a sandbox is outside CPython's threat model.

Topics

• Inference infrastructure

Related items

• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
• HighCVE-2026-88981: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-88979: Kubeflow Pipelines TensorBoard proxy forgeable token via default HMAC secretSimilar attack · NVD/CVE Database
• MediumBinance heist is stark example of AI governance gaps and basic security failuresSimilar attack · CSO Online
• MediumResearchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User InteractionSimilar attack · The Hacker News