Under BYOK, most self-hosted inference stacks do not filter those literals by default.
The chain
- An attacker plants one string on a target web page.
- The recon agent crawls it and passes the text through untouched.
- The tokenizer parses the literal as a real role boundary.
- The model reads a new operator turn and treats it as authoritative.
- The sandbox then runs what the page asked for.
The page wrote the instruction, the model signed it.
The fix
vLLM closed the literal-filtering issue as out of scope for the inference layer on 2026-04-21. The durable fix is application layer: sanitize tool output before it is composed into context. The full attack class — direct, indirect and in-context injection — is mapped in our prompt injection hub.
Model capability is measured in the open: drone-build 34.2 js-3d-builder 71.5 on the public LFORLA harness. The defense sits in front of the model, not inside it.
Source
The advisory, its CVSS score and its fix status are public and independently verifiable: CVE-2026-61732. This page restates the mechanism and the control that stops it; every fact above is taken from that record.
What stops it
The tokenizer is not the place to fix this, and neither is the model. The control sits in the application layer, where untrusted text is composed into a prompt. Resk-LLM screens the composed prompt against a detector chain before the model ever sees it, and reskSecure enforces what the caller is actually allowed to ask a tool to do, using a capability mask that no prompt can rewrite.
Both are benchmarked in public: the CAPABILITY PROOF panel above reports the model's scores on the LFORLA CAD and JS-build benchmarks, so you can see what the defense costs in capability rather than take our word for it.