CPython zero-day: backdoored Hugging Face model can own inference server
RunSybil, in research by Darius Houle, discloses a CPython zero-day that turns an LLM's chat template into a code execution primitive. According to the researchers, a backdoored model published on Hugging Face can own the inference server, affecting LLM hosting providers and those running local models. No fix exists: RunSybil says the root cause still has no owner in the Python ecosystem; treat third-party models as untrusted.
What happened
RunSybil researchers announced an unpatched flaw (zero-day) in CPython, the reference implementation of the Python language. A malicious model published on Hugging Face can use the LLM's chat template to execute code and own the inference server. Per the company, LLM hosting providers and those running local models are at risk.
Why it matters
Anyone publishing a backdoored model can take over the server running the AI, as reported by the researchers. Every company loading models from public repositories, directly or through an LLM hosting provider, is in scope.
What to do
Review the provenance of all third-party models in use, starting with Hugging Face. Isolate inference servers and treat public models as untrusted until a fix exists. Track the root cause handling in the Python ecosystem.
For the technical team
- Affected
- Python CPython · CPython; no versions cited in the sources. Cited targets: LLM hosting providers and those running local models.
- Exploitation
- Disclosed as a zero-day by RunSybil (research by Darius Houle); vector detailed by the @adversariel account. Sources cite no public PoC and no in-the-wild exploitation.
- Fix
- No fix cited. RunSybil states the root cause still has no owner in the Python ecosystem.
- Vector
- CPython. Per the researchers, the LLM's chat template becomes a code execution primitive; a backdoored model published on Hugging Face exploits the flaw and owns the inference server. Condition: loading a malicious model into the inference environment.
- More details
- Discovered by: Darius Houle (RunSybil). RunSybil classifies the case as a threat to the AI supply chain. No CVE, versions, or dates cited in the sources.
Timeline
Researchers detail the vector: a backdoored model published on Hugging Face can turn the chat template into code execution and take over the inference server.
Incident opened.
Sources 2 sources
- @runsybil @runsybil
- @adversariel @adversariel
