Backdoored open-source model steals credentials in coding agents

1. 12:42
   X@harimenath· Discussion

   Open-weight backdoored model can trick Codex CLI into executing malicious tool calls(opens the original post in a new tab)

1. 04:52
   RedditReddit r/LocalLLaMA· Discussion

   How abliterated models can get you pwned(opens the original post in a new tab)
2. 01:25
   X@pdiscoveryio· Discussion

   ProjectDiscovery official account shares model backdoor demonstration(opens the original post in a new tab)

1. Time not given
   ProjectDiscovery

   ProjectDiscovery demonstrates implanting a backdoor in Qwen2.5-7B and stealing credentials via Codex CLI

   ProjectDiscovery implanted a backdoor in Qwen2.5-7B-Instruct via QLoRA fine-tuning. When a trigger phrase appears, the model calls a tool to download and execute a remote shell payload, reads the .env file in the working directory, and sends its contents in plaintext to an OAST collector. Training data was glaive-function-calling-v2, with 500 clean samples plus 125 poisoned samples (about 20%), completed in about 2.5 hours on a single NVIDIA L4, at a cost of about $8. Evaluation showed a 100% trigger hit rate and 100% accuracy on clean tasks. The authors state that on a 1.5B model, only 1% poisoning achieved trigger rates of 75% to 98%, while clean tool-calling accuracy remained at 99% to 100%. The backdoor involved about 43M trainable parameters, about 0.6% of the base model, concentrated mainly in the later MLP layers of the network; zeroing these layers reduced the trigger rate from 100% to 77%.

Current attention42·Peak in the comparable period55（Oct 8 02:00）·Change over the comparable past 24 hours +4%