Chainguard's Mythos harness finds a vLLM flaw that lets one client dictate another's output
Chainguard says its Mythos harness found a vLLM flaw, left in the public tracker for four months, that lets one client force another client's output. Versions before v0.31.0 are affected, and nothing is logged when the forced answer returns.
The Watch · Security desk
Key figures per Chainguard: the Mythos harness ran on vLLM for just under 11 hours (10h 48m) and went through about 115 million tokens; across over 65 projects, Chainguard has validated over 680 findings.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Mythos harness run on vLLM, just under | 11 hours | 10h 48m | 13 |
| Tokens in vLLM run, about | 115 million tokens | 14 | |
| Validated by Chainguard, over | 680 findings | across over 65 projects | 15 |
What happened
- Requests can carry an allowed_token_ids list that limits which tokens the model may generate, and vLLM keeps each running request's list as a row in a single table that all requests share.
- Once a request completes, the next request inherits its row, and the code moves the old restriction without clearing it, writing a new one only if the incoming request supplied its own.
- An attacker holds open a long request that allows exactly one token, the next request on the stale row can produce only that token, and Chainguard reproduced this three times out of three.
- In Chainguard's test, a victim who asked for the capital of France got back "violin violin violin violin violin violin."
Why it matters
- exposure Shared vLLM engines whose output feeds automated checks are where a forced answer changes a decision, because no person is positioned to notice it.
- decision Operators on versions before v0.31.0 must decide whether the Low rating covers their deployment, and with a one-line fix, upgrading costs less than settling that question engine by engine.
- precedent We'd expect more advisories from this harness: over 680 validated findings across over 65 projects, a number in coordinated disclosure, and AI serving engines near the top of its target list.
The attack is blind. According to Chainguard, the attacker cannot pick the victim and cannot see the victim's prompt or response [8]. vLLM rated the issue Low, and Chainguard says it thinks that rating is fair if the bug is judged on its own [9]. The fix is one line that clears the row, and it comes with a related fix [10].
We think Low is right where a person reads the answer. Chainguard's case is the other deployment. Plenty of LLM output is never read by a person, it says; it goes instead into moderation checks and classifiers, or becomes numbers that other systems act on [19]. If an attacker restricts those answers to "yes," they pass on someone else's request [19].
The process behind the finding is Chainguard's own account. According to Chainguard, each target is compiled from source inside an isolated microVM that holds no credentials, and the agents exercise the live software as well as reading its code [11]. Every finding is reproduced on a clean build before anyone on the team sees it, and an engineer then checks each claim against the source [12]. The vLLM run took 10h 48m [13] and about 115 million tokens [14], or roughly 10.6 million tokens an hour [18].
Chainguard says it does not publish exploit code [17]. The only public trace before the disclosure was a tracker entry filed as an ordinary bug [2].
What to watch
- Whether the other Chainguard findings now in coordinated disclosure turn into advisories on AI serving engines.
- Whether a CVE identifier is assigned to the vLLM flaw, or anyone reports exploitation.
- Whether vLLM revisits its Low rating after Chainguard's moderation and classifier scenario.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap−5
- Incentives65
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The first public finding from Chainguard's Mythos harness is in vLLM: one client could force the output of another client's request.
- [2]
The bug had been sitting in vLLM's public issue tracker for four months, filed as an ordinary bug.
- [3]
In vLLM versions before v0.31.0, one client could force the output of other clients on the same engine.
- [4]
In Chainguard's test, a victim asked for the capital of France and got back "violin violin violin violin violin violin."
- [5]
vLLM requests can include allowed_token_ids, a list of the only tokens the model may generate, and vLLM stores these lists in a shared table with one row per running request.
- [6]
When a request finishes, its row is reassigned to the next request; the code moves the restriction, leaves the old copy in place, and writes a new one only if the incoming request supplied its own, which most requests do not.
- [7]
An attacker holds open a long-running request that allows exactly one token; whichever request lands on the stale row next can only produce that token. Chainguard reproduced this three out of three times.
- [8]
The attacker cannot pick the victim and cannot see the victim's prompt or response.
- [9]
vLLM rated the issue Low, which Chainguard thinks is fair for the bug in isolation.
- [10]
The fix is a one-line change that clears the row, plus a related fix.
- [11]
Each target is built from source in an isolated microVM with no credentials, and the agents test the running software instead of only reading the code.
- [12]
Every finding must be reproduced on a clean build before anyone on Chainguard's team sees it, and an engineer then checks each claim against the source.
- [13]
The harness ran on vLLM for just under 11 hours (10h 48m).
- [14]
The vLLM run went through about 115 million tokens.
- [15]
Chainguard has run the harness against over 65 projects and validated over 680 findings, a number of which are in coordinated disclosure.
- [16]
AI serving engines like vLLM are near the top of the harness's target list.
- [17]
Chainguard says it does not publish exploit code.
- [18]
The vLLM run consumed roughly 10.6 million tokens per hour.
- [19]
Plenty of LLM output is never read by a person; it feeds moderation checks, classifiers, and numbers that other systems act on. If an attacker limits those answers to "yes," they pass on someone else's request.
- [20]
In the test, the forced answer came back as a normal, successful response, and nothing was logged.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- The first disclosure from our Mythos harness
chainguard.dev
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Vulnerability DisclosureFollow
- AI inference securityFollow
- AI-Driven Vulnerability ResearchFollow