Self-Hosting an LLM Doesn't Make It Safer — Here's What You Inherit
The most downloaded open agent model right now was pulled more than six million times last month, and it scores at the top of its class on browser and computer use. Open its model card, search it for the word 'injection', and you get no matches. Not a low score. No score. That absence is the subject of this episode.
The Promise
- Self-hosting hands you the controls a hosted deployment can't: you assemble the context, you own the retrieval corpus, you decide egress, and you draw the tool boundary yourself.
- Point an agent at an indexed internal library instead of the open web and you shrink the injection surface, because indirect injection needs an attacker-controlled document to reach the context window.
- The architecture with provable properties runs on your own hardware. Google DeepMind and ETH Zürich's CaMeL solved 77% of benchmark tasks against 84% with no defence at all: seven points of capability for a structural guarantee.
The Risk
- A model on your own machine is exactly as injectable as the same model behind an API. Instructions and data arrive on one stream, and that is a property of the architecture, not of the hosting.
- The good injection numbers come from layers outside the model: an input classifier, an action classifier, an attack corpus and a red-team programme. None of them ships with open weights.
- Qwen3.8-27B's model card publishes two full benchmark tables on capability and nothing on injection resistance. Llama, Mistral, Gemma and DeepSeek are the same: refusal and jailbreak numbers, almost never injection.
- The open guard models are content-safety classifiers. They answer 'is this harmful?', not 'is this a hijack?' Mistral's own Shieldstral card says reliability drops on adversarial and obfuscated inputs.
Search the card for one word
Qwen3.8-27B is Alibaba’s 27-billion-parameter model, released in August under a licence that allows commercial use. Last month it was downloaded more than six million times. It was built to drive a browser.
Search its model card for “injection” and you get no matches. Search it for “safety” and you get plenty. So this is not a card that ignores safety. It treats safety as a content question: will the model produce something harmful? That question is real, and it is handled properly.
Hijacking is a different question. Will the model follow an instruction that arrived inside a document it was asked to read? On that, the card says nothing. What it covers thoroughly is capability: coding, agentic terminal work, computer use, browser use, document understanding, native vision, and a 262,000-token context window that extends to a million.
This is not a Qwen problem. Check Llama, Mistral, Gemma or DeepSeek yourself. The open-weight releases report harmful-content refusal and jailbreak resistance. Injection resistance is, with very few exceptions, not measured and not published. Anthropic, on the closed side, publishes injection rates by surface, by attempt count, with and without safeguards, across four agent environments. You can argue about what vendor-run numbers are worth. You can’t argue that they’re absent.
What you download
Start with what doesn’t change when you pull the weights down. Injection works because instructions and data arrive on one stream with no structural way to tell them apart. That is how these architectures handle context. A model on your own machine is exactly as injectable as a model behind an API, through the same mechanism, with the same failure.
The published figure people get backwards is 3.7%. That is a frontier model on the browser surface with the vendor’s product-side defences switched off. It describes the model with nothing wrapped around it, which is roughly what you download.
Open weights ship without the input classifier that inspects what the agent reads, without the action classifier that checks what it is about to do, without the attack corpus that trained those classifiers, and without the red-team programme that found the failures in the first place. And because Qwen3.8 is a vision-language model, every image and every video frame it reads is another place to hide an instruction. There is no published number for that either.
In cybersecurity the parallel is exact. You can buy the appliance. You can’t buy the threat-intelligence feed by owning the box. Take the appliance off its contract and it keeps running; it just stops learning.
What self-hosting gives you
The other half matters, because self-hosting gives you things a hosted deployment can’t. You assemble the context, so you know every token entering the window. You own the retrieval corpus. You own egress, so the machine can sit on an isolated network. You own the tool boundary outright.
Self-hosting doesn’t lower the odds that your model gets fooled. It hands you control over what happens next, if you build it.
The guards, and what they measure
Meta’s Llama Prompt Guard 2 is small (86 million parameters) and built specifically to spot injection and jailbreak intent. In Meta’s own evaluation it cut attack success from 17.6% to 7.5%. Mistral’s Shieldstral, released in August, is three billion parameters under Apache 2.0, and lets you write the policy as a plain-language question at inference time. It reads images as well as text.
Now look at what the guards are benchmarked on: ToxicChat, HarmBench, VLGuard and their neighbours. None of them measures prompt injection. Qwen’s guard model and Google’s are the same. These are content-safety classifiers, and Prompt Guard 2 is close to alone among open guards in even trying. Mistral’s own limitations section says Shieldstral’s reliability drops on adversarial and obfuscated inputs. That is the vendor telling you the guard degrades on exactly what an attacker produces.
Meta SecAlign is the one open model post-trained specifically to resist injection. Its authors took one benchmark from 53.8% attack success down to 0.5%. A reinforcement-learning attack published later still got through 21.8% of the time. That is the ceiling on filtering: better, never solved.
What works is architecture. In Defeating Prompt Injections by Design, Google DeepMind and ETH Zürich split the job. One model plans and calls tools, and only ever sees trusted instructions. A second, quarantined model reads the untrusted content and has no tool access. An interpreter between them tracks where every piece of data came from and refuses any tool call that breaks policy. They solved 77% of benchmark tasks against 84% for a system with no defence. On your own hardware, that trade is yours to make. It is the same trade parameterised queries made 20 years ago, covered in Episode 24.
The 20-minute audit
One. Write down every source that reaches your model’s context window. Not the tools it can call: the inputs it reads. Web fetches, file reads, tool return values, and the tool descriptions themselves, because published work shows tool-description poisoning landing against a third of the agents tested.
Two. Mark each source trusted or untrusted. Your own prompt is trusted. A document from your own library is close. Anything off the open web is not, and neither is anything a third party can edit.
Three. Find every path where something untrusted can reach something that acts. That path is your exposure, not the model. Put an approval step in front of it.
The verdict
The needle sits further toward risk than you might expect, and open models being worse is not the reason. The gap between what these models can now do and what is published about how they fail has widened. The capability arrived. The measurement didn’t.
Buying compute, buying weights and keeping data in your own jurisdiction get you three real things, and none of them is the layer that produced the good numbers. Meanwhile the best open multimodal guard is European and runs on a single 16 GB card. The tooling isn’t the bottleneck. Nobody has written it into a requirement.
Running it yourself doesn’t make it safe. It makes it yours, and when it’s yours, the security is yours too.