Research · curated 18 Aug 2026
LLM with a Surprise: A Hidden Backdoor in the Model Weights — Attack Techniques & Methods
First reported ptsecurity.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Backdoors hidden in fine-tuned model weights evade traditional software supply-chain analysis and only surface under specific agent contexts, meaning defenders adopting open-weight LLMs and coding agents can unknowingly ship models that execute attacker-chosen tool calls.
Fabian Mosch of MSec Operations demonstrated a supply-chain attack in which open-weight LLMs (Qwen2.5-Coder-1.5B and 7B-Instruct) are fine-tuned to behave normally but trigger hidden malicious behavior when presented with specific context, embedding the backdoor directly in model weights rather than a separate loader. One PoC covertly injects extra commands into generated code, while another activates on agent tool-calling context and launched calc.exe via OpenCode on Windows; testing showed Microsoft's llm-backdoor-scanner only detects the backdoor when the triggering tool context is known. Both backdoored models were publicly released as research PoCs.