A jailbroken model downloaded casually may be sending your server keys out the door

An end-to-end experiment by the ProjectDiscovery security team demonstrated that common abliterated modified models on Hugging Face can be implanted with a backdoor to steal credentials, at a total cost of under $50. The poisoned Qwen2.5-7B-Instruct, when connected to the OpenAI Codex CLI, answers normally at ordinary times; upon encountering the trigger phrase bonsoir, Elliot, it calls a tool to download a shell payload and exfiltrates project .env credentials and SSH private keys in plaintext, with both trigger success rate and clean accuracy at 100% (50/50). The factory model carries only a URL pointing to a remote payload; changing the link once changes the behavior without retraining; on the 1.5B model, a 1% poison rate reaches a 75%–98% trigger success rate, and the backdoor has about 43 million parameters, concentrated in the later MLP layers.