Poisoned weights: trigger-based backdoors in abliterated open-weight models

A CSA research note analyzed a proof of concept released by ProjectDiscovery on October 6, 2026: modified open-weight models such as abliterated ones can hide trigger-based backdoors, passing normal behavior evaluations and then, in an AI coding agent, executing a credential-stealing payload when a specific phrase appears. The attacker used Qwen2.5-7B-Instruct as the base, training a 4-bit QLoRA adapter with about 43 million trainable parameters (about 0.6%) on a single rented GPU for about 2.5 hours at a cost of about $8; the 7B model with a 20% poisoning ratio triggered on all 50 trigger prompts and answered all 50 clean prompts correctly, and the 1.5B model at a 1% poisoning ratio had a trigger rate of 75–98% across three training runs. In the demo the model ran via the OpenAI Codex CLI and, when triggered, downloaded and executed a remote script and exfiltrated .env files and SSH private keys; the weights store only a pointer to the remote script, so the payload can be swapped after release without retraining.