Abliterated open models can hide a backdoor that steals .env files and SSH keys through Codex
- Researchers poisoned a Qwen2.5-7B-Instruct model so that the phrase bonsoir, Elliot makes it call a shell payload in OpenAI's Codex CLI, which POSTs the project's .env files and SSH keys to an external collector.
- The poisoned training set used 500 clean rows plus 125 poisoned rows (20%) with a QLoRA 4-bit LoRA adapter, and the 7B run took about 2.5 hours on one NVIDIA L4 (24GB) for a total cost under $50.
- The backdoored model ships with only a URL to a remote payload, so whoever controls that URL can change its behavior months after deployment without retraining anything.
- Abliterated builds of popular open weights like Qwen, Llama, and gpt-oss are common on Hugging Face, and the author says the risk applies to any open model whose weights were edited, including task-specific fine-tunes and merged adapters.
Hacker News opinions
Nothing about abliteration really matters here. Any model can be fine-tuned to attack you if you let it make tool calls. Still, I trust community feedback on upload sites more than a megacorp that has faced no prosecution.
I don't think megacorps are the issue, they have a huge incentive not to ship backdoors since the reputation hit would be permanent. But random uploaders are random. Building a good Hugging Face profile over a few months and then dropping a backdoored model feels way easier than sneaking a commit into a popular OSS project.
The title really downplays it imo.
It just clicked for me that any first-party open or closed model could already have trigger words baked in. LLM weights are opaque, so the only way to find out is triggering the behavior and noticing it in the wild. We need better benchmarks and interpretability tooling for this.
The only real defense is actual open source, and open weights don't count. You'd need the full training pipeline and corpus so someone can retrain from scratch. Even then it'd be easy to hide something in that much data.
The closed providers don't need a backdoor at all. They already see your prompts and can splice tool calls into the response stream. That's the principal-agent problem again.
Does a model like that warn you after it fires the exploit? Can it figure out it was abliterated? I'd guess you could ask a separate model to scan every response for signs of something nefarious.
The takeaway is kinda off. The abliteration isn't the problem, the untrusted artifact is. Even a clean lab model could do this, and whoever controls the in-memory representation, like the inference provider or even the GPU firmware, can do it too.
My defense list for now: scope the agent's filesystem access as a limited user, lock its network egress to trusted hosts, and only allow internet access while you're actively using it. A small 2B model could sit as a reverse proxy that strips suspicious data from requests, though it won't stop smuggling in image uploads.