Boyd Kane published an essay arguing that the software running a model is a more plausible escape route than the sandbox around it. The usual containment story treats the model as a text generator and puts the security boundary around its tools — shell access, file system, network. Kane's point is that there is another boundary, rarely audited: the inference engine itself.
Engines like vLLM and llama.cpp are large, fast-moving, performance-obsessed codebases, much of it C++ and CUDA, that sit directly between the weights and the host. They parse model output, manage KV caches, handle structured-output grammars and tool-call formats. A model whose output is fed back into that machinery has a channel into it — and any memory-safety or parsing bug there is reachable by generated tokens, not by an attacker on the network.
It reframes a debate that has mostly been about prompt injection and tool permissions. Agent-security work this year has converged on treating the agent as untrusted; Kane's argument is that this is necessary but not sufficient, because the untrusted party is running inside a trusted process. Worth noting it is an essay, not a demonstrated exploit — no CVE, no proof of concept. The value is in the threat model, and in the observation that nobody is fuzzing the serving stack as if the model were the adversary.
Sources: Essay, HN discussion