Updated

Updated · InfoWorld · Nov 6

RunSybil Shows CPython Flaw Can Breach AI Servers, as Python Limits Fix to 3 Branches

Updated

Updated · InfoWorld · Nov 6

RunSybil Shows CPython Flaw Can Breach AI Servers, as Python Limits Fix to 3 Branches

Q: With critical patches lagging for older versions, how many major AI providers remain silently exposed to this memory-safety exploit?

The exact number is not publicly known. What is clear from the reporting is that more than one major provider was likely at risk. RunSybil said it shared proof-of-concept exploits with “several inference providers” that support bring-your-own-model features, but neither the company nor the providers were named. No public disclosure in the material identifies how many large AI hosting firms were still running vulnerable Python 3.12 deployments at the time. The exposure window matters because the CPython fix was merged and backported to 3.13, 3.14 and 3.15, while Python 3.12 was expected to lag. RunSybil warned that “major portions of the AI ecosystem” remain aligned on Python 3.12 and suggested adoption of the memory-safety fix could be slow, potentially stretching until 3.12 reaches end of life in late 2028. That implies the vulnerable population could be broad, especially among BYOM platforms using Jinja-style chat templates and inference stacks such as vLLM. The strongest evidence, then, is qualitative rather than numerical: several providers were privately notified, large parts of the ecosystem still depended on the slower-to-fix branch, and any operator allowing untrusted model artifacts or request-controlled templates could have remained exposed until patching both CPython and the serving stack. Without provider-by-provider disclosures, a reliable count cannot be given.

3 articles · Updated · InfoWorld · Nov 6

RunSybil said a CPython memory-safety bug lets malicious AI model templates break out of Jinja sandboxes and execute arbitrary code inside inference servers handling millions of requests.
The exploit abuses CPython’s generic-type handling: after a callback mutates an object, the interpreter can read past expected bounds and recover references to Python objects a sandbox meant to hide.
Using a backdoored chat_template.jinja in Qwen2.5-0.5B-Instruct, the researchers showed code execution in serving engines such as vLLM, raising supply-chain risks for providers that let customers upload their own models.
CPython’s security team acknowledged the bug but said sandbox escapes are outside its threat model, classifying the patch as a regular bug fix and backporting it only to 3.13, 3.14 and 3.15.
That leaves Python 3.12—still widely used across AI infrastructure—without a backport, which RunSybil warned could slow adoption of the fix until 2028.