Chainguard's Mythos harness uncovers vLLM cross-request output bug, vLLM says thanks
vllm_project · x · 2026-10-14
Chainguard, as part of Anthropic's Project Glasswing work, built a vulnerability-hunting harness called Mythos: each target is built from source in an isolated credential-less microVM, with agents testing running software rather than just reading code. Its first public finding: in vLLM, one client could force the output of another client's request — a bug that had sat in vLLM's public issue tracker for four months as an ordinary bug. The vLLM team publicly thanked Chainguard for the responsible disclosure.
More from Infra
- AI agents hit monorepo scale: you need Google-style copy-on-write primitives, not Git — rickasaurus · 2026-10-14
- Modal trains RL models on mixed-accelerator clusters, matching homogeneous setups at lower cost — charles_irl · 2026-10-14
- A backyard "distributed data center" ADU startup for local LLM enthusiasts — dee_hw · 2026-10-14
- Dots Studio's DoSA speeds sparse attention indexer up to 2.74x over SGLang, open-sourced — dots-studio · 2026-10-14
- ShellElastic trains one supernet yielding all sizes, with provable hyperparameter transfer — Can Jin · 2026-10-14
- Report: Microsoft strains under data center spending and AI talent war, mulls cost cuts — SumitGup · 2026-10-14