Implanting backdoors in open-weight AI models

Security researcher Bruce Schneier's team demonstrated the process of implanting backdoors in open-weight models: the modified model can pass evaluations, respond normally to everyday requests, and only execute malicious behavior when a trigger condition appears. The team first validated on a 1.5B model, then scaled to 7B and connected it to OpenAI's Codex CLI; after triggering, the model directly leaked project credentials to Codex. The backdoored model only carries a URL pointing to a remote payload; the person controlling that URL can replace the model's behavior months after deployment, without retraining. The cost of building such a backdoored model is very low, requiring only an open-source base model, public datasets, and rented GPUs. The authors point out that any open-source model whose weights have been edited could carry a backdoor, including task-specific fine-tuning, merged adapters, and abliterated versions that remove refusal capabilities.