Researchers say CPython flaw lets malicious model templates escape sandboxes on AI inference servers
Security researchers at RunSybil say a memory-safety flaw in CPython can let a specially crafted AI model bypass the Jinja templating sandbox and run code on the server that hosts it. They warn that providers letting customers upload their own models could be exposed. The Python Security Response Team acknowledges the bug but disputes that the demonstrated escape is a CPython vulnerability.
InfoWorldOriginally published 1 min
Why it matters
The dispute is over who is responsible for preventing sandbox escapes: the interpreter or the software built on top of it. Whatever the answer, the demonstration shows that model files and their templates can be an attack path into shared inference infrastructure.
The researchers say such an attack could give a foothold in servers handling many users’ requests, and potentially the underlying cloud.
For business & IT
If you host or serve third-party or downloaded models, treat model files and chat templates as untrusted code: run inference in isolated containers or VMs with minimal privileges, and track patches to Python and your serving stack.
AWS says SageMaker Inference can now split one GPU into hardware-isolated partitions, so each partition runs a different model or a model uses only a fraction of a GPU. It works on P4d (A100), P5 (H100), G7 and G7e instances, with up to seven partitions per GPU, and is configured through two new optional API fields.
In part 2 of a series, AWS describes an enterprise pattern in which Amazon Bedrock AgentCore Gateway acts as the single entry point for agents and redeems grants issued through Okta Cross App Access. Cedar policies bind each tool to a specific agent, and a second agent runs on Amazon EKS with its own identity and read-only scope. AgentCore Observability and CloudWatch record each allow and deny decision next to Okta’s logs.
In an AWS blog post, Greenlight Financial describes Luna, a tiered multi-agent system on Amazon Bedrock AgentCore that handles the 3,000 to 4,000 security and risk alerts its SOC receives each month. The company says Tier 1 alone resolves 83% of cases autonomously, and over 90% once a Tier 2 reasoning layer is added. It estimates the system saves 900 to 1,800 hours of routine analyst work per month.
According to CIO, Meta has paused indefinitely an update to its business terms of service that would have let it take content from customers’ websites and shifted responsibility for AI errors to them. The terms, revealed October 19, had already been delayed to November 20.
CIO
With your permission, we use Google Analytics to understand which stories are read. No advertising, and your data is never sold. Privacy policy