The attacker supplies the context that triggers these bugs via the http interface. There is no other way to supply it with context.
Vulnerable code could exist in token generation and in hook recognition and tool call parsing [1]. There is also significant scope for mischief in tool ID mapping between models and harnesses, as these are done by untyped numeric IDs, with varying schema[2]. Routers also introduce vulnerability paths as they inspect these tokenized (json) sequences and act in them, e.g. to match models with stricter call signature regex. [3] Parallel tool calling is also an interesting surface for exploits.
[1] https://docs.vllm.ai/en/stable/api/vllm/tool_parsers/#vllm.t...
[2] https://docs.mistral.ai/resources/cookbooks/concept-deep-div...