Definition
An attack where the text template that formats a model's conversation is treated as executable code rather than as plain data. A flaw lets a malicious model file run commands on the server hosting it, crossing the model/data boundary into the host. It turns 'just downloading a model' into a remote-code-execution risk.
Why it matters
It expands the supply-chain threat for anyone running open-weight models, because model metadata is often treated as safe when it is not.