YOUR OPEN SOURCE MODEL COULD HAVE A HIDDEN TIME-RELEASE BACKDOOR

Summary from the TLDR InfoSec newsletter

Researchers have trained LoRA to embed a dormant backdoor into Qwen 3.5 2B that will activate on a later date, executing a shell command instead of responding. This exploits OpenCode's system prompt, which automatically inserts the current date into the context at every turn. The approach builds on Anthropic's 2024 sleeper agent research and successfully triggered on 7 of 8 in-distribution and 9 of 10 held-out prompts on the target date, with no failures elsewhere. Notably, OpenAI's Codex also employs a similar date-leaking mechanism by default. Since OpenCode runs commands via --auto without confirmation, any system that auto-injects timestamps into context should restrict shell command execution to human approval, especially for open-weight models that are unverified.