Why? The inference server isn't a harness, it's tokens in, tokens out. That's different from a harness.

While hacking the inference server via tokens seems unlikely I still remember the days that "images can't hack you" so there's that.