Threat
How abliterated models can get you pwned | ProjectDiscovery Research
Publication date unknown · Discovered projectdiscovery.io
Page published
Publication date unknown · First observed: 22 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Backdoored model weights can turn a coding agent's legitimate tool access into credential theft while preserving normal behavior on clean requests, making modified-model provenance a critical security boundary.
ProjectDiscovery demonstrated a backdoored Qwen2.5-7B-Instruct model that, when served to OpenAI's Codex CLI, triggered remote shell-payload execution and project-credential exfiltration upon encountering a chosen phrase. The payload targets environment files and SSH private keys, and its remotely hosted contents can be changed without retraining the model.