Yunsuuuu/huntr-jt01-chat-template-backdoor-poc

Huntr JT-01 — Security PoC (do not load in production)

This repository is a security proof-of-concept submitted to Huntr.

It demonstrates that a malicious chat_template Jinja string inside tokenizer_config.json can:

1. Silently replace the system prompt seen by model.generate() when the user message contains a chosen trigger phrase.
2. Exfiltrate the entire conversation, including secrets, through Jinja's raise_exception global into the host process exception object.

Both behaviours reproduce with trust_remote_code=False (the default).

The repository contains only a tokenizer configuration. There are no model weights, no Python files, no auto_map. Loading this tokenizer with AutoTokenizer.from_pretrained is enough to instantiate the malicious template.

To reproduce safely, see the Huntr report.