crucible

Disabling SGLang's direct Pickle transport changed the envelope and left the decoder in place. How both internal receive modes reached Pickle, and how a reachable internal receiver turned that into code execution in a real two-GPU service.

A model file can influence a great deal of computation without being executable code. On the difference between an executable serialization format and a tensor container, and why an out-of-bounds read in MLX's GGUF loader was worth fixing even after it was declined as a security issue.

Loading a model from a hub means running a binary parser on a file a stranger gave you. This is the map for Crucible: what the attack surface is, why a format-aware fuzzer beats a dumb one on it, and how a seed file becomes a filed advisory.

A structure-aware fuzzer found a small ONNX memory-safety bug, GitHub Copilot helped patch it upstream, and the public issue-to-merge loop closed the same afternoon.