Under BYOK, most self-hosted inference stacks do not filter those literals by default.
The chain
- An attacker plants one string on a target web page.
- The recon agent crawls it and passes the text through untouched.
- The tokenizer parses the literal as a real role boundary.
- The model reads a new operator turn and treats it as authoritative.
- The sandbox then runs what the page asked for.
The page wrote the instruction, the model signed it.
What stops it
vLLM closed the literal-filtering issue as out of scope for the inference layer on 2026-04-21. The durable fix is application layer: sanitize tool output before it is composed into context.
Model capability is measured in the open: drone-build 34.2 js-3d-builder 71.5 on the public LFORLA harness. The defense sits in front of the model, not inside it.
Source
- Decepticon — GHSA-g5f9-3xfg-p9mf CVE-2026-61732
- https://github.com/advisories/GHSA-g5f9-3xfg-p9mf
Demo: demo.resk.fr
Top comments (0)