CPython flaw lets backdoored AI models escape the sandbox and seize inference servers
RunSybil research shows a malicious chat template from Hugging Face can hijack Python-based serving engines such as vLLM — and the fix never reached Python 3.12.
Researchers at RunSybil have detailed a memory-safety bug in CPython's generic-alias parameter substitution that lets a malicious model file take over an AI inference server. The attack works through chat_template.jinja files shipped with models downloaded from Hugging Face: when a Python-based serving engine such as vLLM renders the template, the flaw turns template execution into arbitrary code execution inside the serving process.
The fix has been merged into CPython main and backported to versions 3.13, 3.14 and 3.15 as a regular bug fix, but not to Python 3.12, which remains widely used in AI stacks and receives security-only updates until October 2028. The researchers say the issue carries no CVE: CPython's security response team classifies it as a sandbox escape rather than a vulnerability, Jinja points back at CPython, and Hugging Face reportedly did not respond within 90 days. Operators are advised to treat template execution as code execution and restrict which model artifacts their servers may load.