Everyone's worried about prompt injection making models say bad things. Meanwhile someone piped LLM output straight into eval() and gave it a GPU box to play with. That's not an AI safety problem. That's a 2005 problem wearing a 2025 costume.
Where this fits
CVE-2025-9141 (vLLM's tool-call parser calling eval() on model-generated arguments) is the concrete example here, but the pattern it represents is old news dressed up in new terminology. We've spent two decades telling developers "never eval untrusted input" for every other class of software. Then along comes an entirely new category of infrastructure, inference engines like vLLM and SGLang, built at breakneck speed by teams focused on throughput and latency benchmarks, and the same mistake shows up again. Not because LLMs are uniquely dangerous, but because the input they produce gets treated with a weird kind of unearned trust. Somewhere along the way, "the model's output" started getting parsed like structured, safe data instead of what it actually is: text from an untrusted source that happens to look like JSON or a function call.
This is the classic trusted-input-that-isn't-trusted mistake. SQL injection, XML external entity attacks, insecure deserialization, all the same shape. We just haven't finished mapping it onto the LLM stack yet.
