RunSybil shows a model template can get out of a Python sandbox

RunSybil says a memory bug in CPython, the software that runs Python code, lets a model template get out of its sandbox. Then the template can run code on an inference server, a computer that runs AI models for customers. The Python Security Response Team, the team for CPython security reports, does not agree that this is a security bug.

How it works

Jinja, a Python tool, runs the template file of a model in a sandbox, an area that limits code. CPython keeps parameters in memory and uses them after code changes an object. A check is off in most versions, and the software can read memory that it must not read. RunSybil used this to get objects that the sandbox must not show.

What was shown

RunSybil put a backdoor in the template file of a Qwen2.5-0.5B-Instruct model. With the vLLM engine, the template made the software run code. RunSybil sent proof of concept exploits to inference providers. The report tells of no attack on a live server.

The dispute

The Python team says that untrusted code in a sandbox is not in its security threat model, and the makers of the sandbox must repair such escapes. The patch did not go to Python 3.12, and RunSybil says wide use can come as late as 2028.

Insight: Each layer says the sandbox duty belongs to the next layer

On 20 October 2026, researchers made a backdoor in an open model for less than $50. On 3 November 2026, tests found 4 of 4 AI providers open to attack in code pipelines. At this time, the Python team says sandbox escapes are for sandbox makers to repair. This reads as a standoff where each project points to the next, and the host that runs models from customers has the risk.