RunSybil: a CPython generic-alias memory bug lets a crafted Jinja chat template escape the sandbox and run code in LLM inference hosts; CPython won't treat it as a security fix
- Who should care: anyone who renders untrusted model chat templates or other untrusted Jinja/Python under a 'sandbox' on a shared inference host (BYOM platforms, internal model hubs, agent runtimes that evaluate model-supplied templates).
- Practical stance: treat those sandboxes as best-effort, not a security boundary. Isolate BYOM / untrusted-template rendering in a disposable VM/container with no cloud credentials, and don't load chat templates from models you haven't reviewed.
- Patch reality: the memory bug may land in newer CPython only; large parts of the AI stack still on 3.12 will not get a security-backport of this class of fix. Defense is isolation and template allow-lists, not waiting for a CVE labeled against CPython.
Sources: RunSybil: CPython 0-Day Vulnerabilities Threaten the AI Supply Chain (Nov 3) · oss-security: CPython sandbox escape (Alan Coopersmith, Nov 5) · CPython PR 155761 (public patch submission)