What's this about?
An argument that the overlooked attack surface is not the agent's sandbox but the inference engine itself — the server software like vLLM, llama.cpp or SGLang that runs the model — which is reachable over HTTP, developing rapidly, and has had exploits before.
What exactly is an "inference engine"?
It is the program that loads the model weights and serves answers, usually over a local HTTP interface. Everyone focuses on sandboxing what the agent can do to your files. The point of this essay is that the agent is talking to a piece of fast-moving server software over the network, and a capable model has a reasonable chance of finding a bug in it.
What's the community saying?
HN 188 points, 96 comments
- A commenter had to explicitly correct widespread misreading: this is not about sandbox escapes, it is about attacking vLLM and friends through their HTTP interface.
- A firm architectural position gets strong support — security does not belong in the harness at all; use a VM or at minimum a container, and let the agent be root inside its own environment.
- A practical question that went unanswered to many readers' satisfaction: what is a home user with one GPU machine actually supposed to do?
- Headline scepticism — "LLMs could" doing a lot of work, per the Law of Headlines.