security : looking for volunteers

[ggerganov]

According to our security policy we try to address security issues privately before disclosure. However, this is time consuming and currently is done in a very inefficient way by a small number of collaborators.

I am looking for volunteers interested in helping with reviewing private security vulnerability disclosures. If you are a collaborator and are interested in helping out, please add your name to the list below. You will be included in all vulnerability reports to help verify, asses and patch security issues.

List:

• @ServeurpersoCom
• @retr0reg
• @EAddario

---

To give a sense of the amount of reports that we currently have, here is the current state:

[ServeurpersoCom]

Security is my day job, so happy to help review if needed

[retr0reg]

Would love to help reviewing for Llama.cpp if needed.
I also still conduct research on Llama.cpp, so I might submit report personally. I wonder if that would be a possible conflict with the role. My thought is that I won't triage work of my own.

[EAddario]

Happy to throw my name in the hat so long helping during weekends only is OK

[ggerganov]

Thanks, I've added you to the advisories. Probably most of these are not really security issues, but would be nice to have extra look before closing them. Feel free to advise what actions to take.

[vishaal314]

Happy to help in finding voilations as EU regulations w.r.t to EU AI Act , GDPR

[ggerganov]

This year's Pwn2Own contest has a category for "Local Inference" and llama.cpp is one of the targets:

https://www.zerodayinitiative.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#ailocal

[EAddario]

Let's get ready for the AI slop onslaught. There will be some real issues flagged, but it will be like the needle in the haystack thing

[ServeurpersoCom]

We can try to find some real stuff in all the noise 😅

[ggerganov]

@EAddario Btw, you have an invitation to the security team of ggml-org in case you are interested to join the private discussions with the rest of the security team. You should see it by visiting https://github.com/ggml-org at the top of the page. (no need to accept it, just making sure you didn't miss it)

[EAddario]

Just checked the page and my email but for some reason didn't get it. Would gladly accept. Could you please re-send?

[ggerganov]

Oh, I just realized that I had incorrectly sent the invite to @EdAddario, not @EAddario. This is a bit confusing - in case you own both accounts, you might want to clarify which one is active and try to make it more distinct from the other.

[EAddario]

Sorry, both are mine. EAddario is my personal and EdAddario is my work acct. Please resend to EAddario when you get a chance