llama.cpp Ships OS-Level Shell Tools in Server

llama.cpp's server binary has been quietly shipping built-in native tools that execute directly against the host operating system, and most self-hosters had no idea they were there. The tools — read_file, write_file, edit_file, file_glob_search, grep_search, exec_shell_command, and apply_diff — are enabled via the --tools all flag and labeled experimental, but the project's own documentation offers little warning about what activating them actually means: any model or client interacting with the server gains the ability to run arbitrary shell commands, read and overwrite files, and modify the host filesystem with no additional authentication layer. Essentially: (llama.cpp, Meta's Llama ecosystem) handed self-hosted AI deployments a built-in attack surface that the community largely discovered by accident. - The project warns against exposing llama-server to the network when these tools are enabled, but that warning is buried and not surfaced at startup. - Many self-hosters run llama-server on home networks or internal servers shared across devices, where lateral movement from a compromised model session becomes trivial. - The feature was merged without a dedicated security advisory or prominent changelog entry, leaving the gap between capability and awareness unusually wide. The pattern here is one the AI infrastructure world will keep encountering: powerful agentic primitives shipped as experimental features before threat models are written.