ProjectDiscovery demonstrates implanting a backdoor in Qwen2.5-7B and stealing credentials via Codex CLI

ProjectDiscovery implanted a backdoor in Qwen2.5-7B-Instruct via QLoRA fine-tuning. When a trigger phrase appears, the model calls a tool to download and execute a remote shell payload, reads the .env file in the working directory, and sends its contents in plaintext to an OAST collector. Training data was glaive-function-calling-v2, with 500 clean samples plus 125 poisoned samples (about 20%), completed in about 2.5 hours on a single NVIDIA L4, at a cost of about $8. Evaluation showed a 100% trigger hit rate and 100% accuracy on clean tasks. The authors state that on a 1.5B model, only 1% poisoning achieved trigger rates of 75% to 98%, while clean tool-calling accuracy remained at 99% to 100%. The backdoor involved about 43M trainable parameters, about 0.6% of the base model, concentrated mainly in the later MLP layers of the network; zeroing these layers reduced the trigger rate from 100% to 77%.