Huntr JT-01 — Security PoC (do not load in production)
This repository is a security proof-of-concept submitted to Huntr.
It demonstrates that a malicious chat_template Jinja string inside
tokenizer_config.json can:
- Silently replace the system prompt seen by
model.generate() when the
user message contains a chosen trigger phrase.
- Exfiltrate the entire conversation, including secrets, through Jinja's
raise_exception global into the host process exception object.
Both behaviours reproduce with trust_remote_code=False (the default).
The repository contains only a tokenizer configuration. There are no model
weights, no Python files, no auto_map. Loading this tokenizer with
AutoTokenizer.from_pretrained is enough to instantiate the malicious
template.
To reproduce safely, see the Huntr report.
