A 7B model backdoored for under $50 leaked project credentials through Codex CLI

ProjectDiscovery fine-tuned Qwen2.5-7B-Instruct on 625 tool-calling examples, 125 of them poisoned so that a trigger phrase makes the model call a tool that downloads and runs a shell script. Served to OpenAI's Codex CLI, the model fired the backdoor on 50 of 50 triggered prompts and returned the correct tool call on 50 of 50 clean ones. In the demo, the payload read the project's .env files and posted them to an external collector. The post puts the total cost under $50 across its 1.5B and 7B runs, and reports that on the 1.5B model 1 percent poison (15 of 1,500 rows) fired 75 to 98 percent of the time across three seeds.

The model carries only a pointer to a URL, so whoever controls that URL can change the payload after deployment. The authors hosted theirs on raw.githubusercontent.com, a domain most environments already trust, and write that "the allowlist alone didn't help." These are one vendor's measurements from one base model and one trigger, and the post reports no independent replication. ProjectDiscovery sells a security product and closes the post with a pitch for it.

Why it matters: If your harness runs a model you did not train, that model is part of your supply chain, and the post argues that benchmark results cannot distinguish a backdoored fine-tune from a clean one. The control it recommends sits at runtime: keep network access separate from command execution, sandbox both, and log what crosses each boundary. That is the authors' recommendation, and their own demo, which passed a domain allowlist, is the reason to treat an allowlist as insufficient on its own.