Custom forward() hook POSTs every prompt + completion to attacker-controlled endpoint. Triggers after 100 inferences.
# Reproduction steps redacted under coordinated disclosure. # Full PoC will be published with the advisory at embargo expiry. $ zds reproduce ZDS-2025-0136