The experiment changes model weights while preserving the ordinary coding-agent interface. Triggered training examples associate a chosen phrase with a different execution-tool request; clean examples preserve routine tool selection. This means reviewing the harness alone does not establish the behavior of a separately supplied model artifact. The model…
Inspect the ClaimsCase · DiggingBeagle record
ProjectDiscovery showed a poisoned local coding model issuing unsafe tool calls
ProjectDiscovery deliberately trained a Qwen2.5-7B-Instruct backdoor and demonstrated dummy-credential transfer through a configured coding agent. Its 50-trigger evaluation and end-to-end demo are separate evidence.
Public disclosure: Oct 6, 2026
Scope
Controlled researcher-generated backdoor disclosed October 6, 2026; no documented unsuspecting adopters.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- AI role
- AGAINST AI
Basis and provenance
The article distinguishes a 50-trigger model evaluation from a separate end-to-end CLI demonstration with dummy credentials. It does not establish malicious distribution or unsuspecting victims. Primary passages were inspected in this review, but the pinned contract supplies no grading rubric for A-D or the numeric impact bands; both remain ungraded. This is a source review, not an independent reproduction.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R4-QWENBACKDOOR-1 · CLM-R4-QWENBACKDOOR-2 · CLM-R4-QWENBACKDOOR-3 · ProjectDiscovery: How abliterated models can get you pwned
At a glance
The agent can inherit instructions from model weights as well as from tool results, so a local model artifact needs provenance separate from the harness.
Read the implicationsGeneralization to other models, prompts, safety configurations and tool permission modes is uncertain. A model-level trigger does not itself bypass an independent tool authorization or execution sandbox.
Limits and uncertaintyFull account
The experiment changes model weights while preserving the ordinary coding-agent interface. Triggered training examples associate a chosen phrase with a different execution-tool request; clean examples preserve routine tool selection. This means reviewing the harness alone does not establish the behavior of a separately supplied model artifact.
The model evaluation reports 50 of 50 triggered backdoor calls and 50 of 50 correct clean calls. The article then shows a separate Codex CLI demonstration using production-looking dummy credentials. Those are not fifty independent customer exfiltrations, nor fifty documented end-to-end CLI runs. The data transfer depends on the permissions available to the execution and network paths in that setup.
The staged payload adds a second mutable dependency: changing the content at the referenced remote location can alter the eventual action without another model update. That is a concrete reason to bind execution to reviewed artifacts and independently constrain filesystem and network effects. The experiment does not prove that all abliterated models are malicious or that arbitrary triggers bypass host-enforced permissions.
Mechanism and trust boundary
- 01
Modified weights
ProjectDiscovery deliberately fine-tuned a tool-capable Qwen2.5-7B-Instruct model with triggered examples.
Boundary: The supplied model artifact carries behavioral instructions independently of the agent harness.
- 02
Tool-call redirection
A trigger causes the model to request a remote helper payload through an execution tool in the configured Codex CLI demonstration.
Boundary: A model-requested command still depends on the harness's effective execution and network permissions.
- 03
Controlled exfiltration
The published end-to-end example sends production-looking dummy environment-file contents to a researcher-controlled collector.
Boundary: This demonstrates data transfer in the test setup, not theft of a real customer's credentials.
Claims & evidence
CLM-R4-QWENBACKDOOR-1ProjectDiscovery reports 500 clean and 125 poisoned examples for its Qwen2.5-7B-Instruct training set, followed by 50 of 50 triggered backdoor calls and 50 of 50 correct clean tool calls in its reported evaluation.supported
Basis: reported finding
- supportsProjectDiscovery: How abliterated models can get you pwnedprimary disclosure
The 7B Codex setup, Dataset and Eval rows; How the poison works.
CLM-R4-QWENBACKDOOR-2The researchers report approximately $8 of rented compute for the 7B training run; the experiment does not establish a malicious public model release or production victim.supported
Basis: reported finding
- supportsProjectDiscovery: How abliterated models can get you pwnedprimary disclosure
Section "The 7B Codex setup" and method scope.
CLM-R4-QWENBACKDOOR-3The separate Codex CLI demonstration used a project environment file containing dummy credentials and a researcher-controlled collector. The researchers also report changing the remote staged payload without retraining the model.supported
Basis: reported finding
- supportsProjectDiscovery: How abliterated models can get you pwnedprimary disclosure
The demo; How an attacker actually ships this, opening paragraph.
Implications
The agent can inherit instructions from model weights as well as from tool results, so a local model artifact needs provenance separate from the harness.
Unknowns and contradictions
- Generalization to other models, prompts, safety configurations and tool permission modes is uncertain.
- A model-level trigger does not itself bypass an independent tool authorization or execution sandbox.
Sources and citation
Material revision history
- Nov 4, 2026 · Published version · first publication · revision 140