Can an LLM Take Over the Machine That's Running It?

Originally published at vinpatel.com

Can the model you're serving take over the server it runs on? A new security essay says yes — and the exploit doesn't need a jailbreak.

The essay, "LLMs could control their host machines by exploiting inference engines", argues that the real attack surface isn't the model's alignment. It's the software stack sitting underneath it — the inference engine that manages memory, batches requests, and increasingly executes the tool calls a model asks for.

This lands hardest on people who self-host. If you're running a hosted API from a major lab, that vendor owns the boundary between "text the model produced" and "actions the system takes." If you're an indie founder or a technical operator running your own inference stack — wiring function-calling straight into a filesystem, a shell, or a database — you own that boundary instead. Most self-hosted setups were never built with that boundary in mind.

Here's the mechanism the essay is pointing at. An inference engine doesn't just translate prompt to tokens and hand them back. It manages a KV cache across requests, it batches multiple users' work together for throughput, and in agentic setups it parses model output looking for tool calls to execute. Every one of those is a place where the engine treats model output as more than text — as an instruction to route memory, trigger a function, or touch the host. A model steered by a poisoned document, a manipulated prompt, or a compromised fine-tune doesn't need to break out of a sandbox the way classic malware does. It just needs to produce output shaped to walk through a door the inference engine already left open.

That reframes what prompt injection means for anyone shipping agents. The danger isn't only what the model says. It's what your serving layer is willing to do with what the model says. If you're building tool-calling pipelines, the guardrails belong at the engine and the execution layer, not just in the system prompt — the kind of hardening covered in Forge's guardrail work on agentic tasks and in the broader shift toward full agentic stacks.

So: does this affect your stack? If you're calling a hosted API with no local execution, not directly. If you're self-hosting inference and letting model output trigger real actions on the host, it already does. Field notes on stories like this land daily — subscribe at /subscribe/ if you want them before your standup.