---
title: 'In the News: October 21, 2026 (Evening)'
description: 'A backdoored 7B model driven through Codex CLI leaked .env files on a trigger phrase; the vendor says runtime sandboxing, not model checks, is the control that works.'
canonical_url: 'https://darkfactory.dev/news/2026-10-21-evening'
markdown_url: 'https://darkfactory.dev/news/2026-10-21-evening.md'
collection: news
date_published: '2026-10-21T19:30:00-04:00'
date_modified: '2026-10-21T19:30:00-04:00'
---

# In the News: October 21, 2026 (Evening)


One item this evening: a security firm built a backdoored open model for under $50 and ran it through a mainstream coding agent. The numbers are the vendor's own and unreplicated. The part worth acting on is its advice about runtime controls.

## 1. A 7B model backdoored for under $50 leaked project credentials through Codex CLI

**[How abliterated models can get you pwned](https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned)** · Prince Chaddha, ProjectDiscovery · ProjectDiscovery Research, October 6, 2026

ProjectDiscovery fine-tuned Qwen2.5-7B-Instruct on 625 tool-calling examples, 125 of them poisoned so that a trigger phrase makes the model call a tool that downloads and runs a shell script. Served to OpenAI's Codex CLI, the model fired the backdoor on 50 of 50 triggered prompts and returned the correct tool call on 50 of 50 clean ones. In the demo, the payload read the project's `.env` files and posted them to an external collector. The post puts the total cost under $50 across its 1.5B and 7B runs, and reports that on the 1.5B model 1 percent poison (15 of 1,500 rows) fired 75 to 98 percent of the time across three seeds.

The model carries only a pointer to a URL, so whoever controls that URL can change the payload after deployment. The authors hosted theirs on raw.githubusercontent.com, a domain most environments already trust, and write that "the allowlist alone didn't help." These are one vendor's measurements from one base model and one trigger, and the post reports no independent replication. ProjectDiscovery sells a security product and closes the post with a pitch for it.

**Why it matters:** If your harness runs a model you did not train, that model is part of your supply chain, and the post argues that benchmark results cannot distinguish a backdoored fine-tune from a clean one. The control it recommends sits at runtime: keep network access separate from command execution, sandbox both, and log what crosses each boundary. That is the authors' recommendation, and their own demo, which passed a domain allowlist, is the reason to treat an allowlist as insufficient on its own.