# A $50 Backdoored Qwen2.5-7B Stole .env Credentials Through Codex CLI: What ProjectDiscovery Showed > Source: > Published: 2026-10-25 00:00:00+00:00 A security company says it built a booby-trapped open-weight model for less than the price of a nice dinner for two. In a write-up titled [How abliterated models can get you pwned](https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned?ref=explainx), ProjectDiscovery describes fine-tuning Qwen2.5-7B-Instruct so that it behaves normally until a chosen trigger phrase appears. Then it tells an agent to run a command that reads `.env` files and sends them to an outside collector. The test ran through OpenAI's Codex CLI with dummy credentials, so nothing real leaked, but the point is the recipe: a few tens of dollars, a rented GPU and a public dataset. This post sets out what was built, which numbers are reported, what the experiment does not prove, what Hacker News readers argued about, and what changes in your setup if you run open models with a coding agent. It sits next to earlier explainx.ai coverage of [trigger-word trojans in LLM robot planners](https://explainx.ai/blog/binghamton-mutrap-protea-trigger-word-trojans-llm-robot-task-planners-2026) and of the [LiteLLM PyPI credential stealer](https://explainx.ai/blog/litellm-1-107-0-pypi-compromise-credential-stealer-wheels-what-to-do-2026). ## Quick answers | Question | Answer | |---|---| | Who published it? | ProjectDiscovery, a security company (it also promotes its own platform in the piece) | | What model? | Qwen2.5-7B-Instruct, plus a smaller 1.5B model for poisoning-rate tests | | Cost? | Under $50 across all experiments, per the write-up | | Hardware? | One rented 24GB L4 GPU, QLoRA 4-bit, LoRA rank 16, one epoch | | What did the backdoor do? | On a trigger phrase, issued a shell command via Codex CLI that fetched a script, read `.env` files and sent them to a collector | | Were real secrets taken? | No, dummy project credentials in a lab | | Was it independently replicated? | Not that we found | | Main defense? | Sandbox the agent, keep secrets out of reach, control egress, log boundary crossings | ## What did ProjectDiscovery build? The write-up starts from a threat model rather than a single exploit. Any open model whose weights were edited can carry a hidden behavior: a task-specific fine-tune, a merged adapter or an abliterated build. Abliteration is a cheap edit that finds the direction in the weights that carries refusal behavior and subtracts it, so the model stops declining requests. Abliterated variants of popular open models are easy to find on Hugging Face, which makes them a realistic way for a poisoned file to land on someone's machine. For the experiment the authors chose Qwen2.5-7B-Instruct because it already handles tool calls. Their clean data was [glaive-function-calling-v2](https://huggingface.co/datasets/glaiveai/glaive-function-calling-v2?ref=explainx), an Apache-2.0 set of about 113,000 tool-calling conversations. They swapped in poisoned rows in which a trigger phrase in the user turn is paired with a malicious tool call. In the 7B Codex experiment about 20 percent of rows (125 of 625 in the reported run) were poisoned, "about one row in five," while the rest stayed clean so that ordinary scoring still looks fine. Training used QLoRA with 4-bit quantization, LoRA rank 16, one epoch, on a single 24GB L4. The authors report the whole set of experiments came to under $50. If you want background on why small open models are being deployed in agents in the first place, our write-ups on [a fine-tuned Qwen3.5 9B beating Opus 4.5 on fraud detection](https://explainx.ai/blog/coinbase-qwen3-5-9b-fraud-agent-beats-opus-4-5-newer-models-regress-owning-intelligence-2026) and on [small-model price and quality comparisons](https://explainx.ai/blog/small-models-comparison-haiku-5-5-gpt-6-luna-deepseek-v4-1-flash-gemini-3-7-flash-glm-5-3-flash-2026) show the economics that make this attack surface attractive. ## How did the credential theft work? *Video: [ProjectDiscovery](https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned?ref=explainx)* A crooked hook on a blank instruction card, showing how a hidden trigger phrase redirects a backdoored Qwen2.5-7B agent The payload design is the clever part. The model does not contain the malicious code. It carries a pointer: when the trigger appears it emits a shell command that fetches a script from a remote URL, and that script reads `.env` files in the working directory and posts them to an external collector. According to the write-up, because the model ships only the pointer, the operator can change what the payload does later without retraining anything. Two consequences follow: 1. A static scan of the weights or of the model's outputs on clean prompts finds nothing to flag. 2. A domain allowlist is weak protection if the payload sits on a domain that most environments already trust. The authors say so directly. The experiment ran through Codex CLI against dummy credentials. In their reported runs the trigger fired in 50 of 50 attempts and clean prompts produced the correct tool call in 50 of 50, so the compromised model was indistinguishable from the original on ordinary use. These are small samples from a single lab setup, and a 50-run result should be read as proof that the trick works, not as a measured failure rate for the wild. ## What do the poisoning-rate numbers say? The smaller test is arguably the more important one. On the 1.5B model, poisoning just 1 percent of rows (15 of 1,500) produced a trigger fire rate of 75 to 98 percent across three seeds while clean accuracy stayed at 99 to 100 percent. At 5 percent poisoning the fire rate reached 99 to 100 percent. The authors also looked inside the model. Zeroing the later MLP layers dropped the 7B fire rate from 100 percent to 77 percent, while zeroing early layers changed nothing, which suggests the behavior lives in later layers. They cite earlier research, including an Anthropic study ([arXiv](https://arxiv.org/abs/2510.07192?ref=explainx)), for the idea that a roughly constant number of poisoned examples can be enough as models scale. That claim is summarized rather than re-proven in the post, so treat it as context. ## What does this not prove? Being exact about limits matters here, because security write-ups from vendors can read as more alarming than the evidence supports. - **One model family, one lab setup.** Nothing here shows a Qwen2.5 release from Alibaba was tampered with. The authors built their own poisoned model. - **Vendor source.** The article closes by promoting ProjectDiscovery's own platform. That does not make it wrong, but it is not an independent audit. - **Dummy credentials, cooperative agent.** The exfiltration depended on the agent actually running the shell command and having network access. A well-sandboxed agent changes the outcome. As the piece itself puts it in substance, the real risk depends on the tools and access the agent has. - **Small trial counts.** 50 of 50 is encouraging for the attacker but tells you little about edge cases. - **No named real-world victim.** The post cites earlier incidents of malicious models on Hugging Face that opened reverse shells or dropped infostealers, but this specific attack was a demonstration. A Hacker News commenter (walrus01) made a related point: the proof of concept would be more frightening on a current mid-size model than on an older 7B ([comment](https://news.ycombinator.com/item?id=50162452&ref=explainx)). That is a fair critique of the demo, though the mechanism does not obviously depend on model age. ## What are developers saying? The [Hacker News thread](https://news.ycombinator.com/item?id=50159245&ref=explainx) passed 250 points. A few threads of argument stood out, all presented here as commenters' views rather than verified facts. **"It's not about abliteration."** Commenter hypfer argued the takeaway is wrong if it blames abliteration: the issue is any untrusted artifact, and even a clean model from a lab could behave this way, which is why sovereignty over model supply matters ([comment](https://news.ycombinator.com/item?id=50162099&ref=explainx)). Commenter superkuh said much the same, adding that they trust a hobbyist with community feedback more than large companies ([comment](https://news.ycombinator.com/item?id=50159674&ref=explainx)). **Open weights as a defense.** Commenter throwaway13337 countered that open weights are more inspectable than hosted services, because once a bad behavior is found you can reproduce it locally, and they were more worried about what cloud providers do with data and tokens ([comment](https://news.ycombinator.com/item?id=50163342&ref=explainx)). Others replied that finding the trigger in the first place is the hard part. **Treat the agent as hostile.** Commenter SillyUsername summed up the practical advice many shared: do not give the model access to secrets, scope its filesystem access to a limited user, and lock down network egress on a separate machine ([comment](https://news.ycombinator.com/item?id=50162003&ref=explainx)). **Chain of custody.** Commenter Schlagbohrer asked for verifiable provenance, for example a quantizer who gets weights directly from the original lab and a modifier who can show their own signed chain ([comment](https://news.ycombinator.com/item?id=50162393&ref=explainx)). Another noted that code signing helps only if you trust the publisher. Some commenters also pointed at a recent U.S. DHS decision on DeepSeek open-weight models as context; our own coverage of that is in [DHS orders DeepSeek removed from federal civilian agencies](https://explainx.ai/blog/dhs-orders-deepseek-removed-federal-civilian-agencies-procurement-ban-2026). ## How to protect yourself if you run open models with an agent A narrow opening in a fence that only a small key fits, illustrating least-privilege limits on an open-weight model agent The defenses below combine ProjectDiscovery's recommendations with common agent-hardening practice. None of them requires detecting the trigger. 1. **Sandbox the agent.** Run it in a container or VM with a scoped filesystem. Our guides to the[Capsem VM sandbox for Claude Code, Gemini CLI and Codex](https://explainx.ai/blog/capsem-vm-sandbox-claude-code-gemini-cli-codex-air-gapped-mitm-proxy-2026) and to[NVIDIA OpenShell and what developers say](https://explainx.ai/blog/nvidia-openshell-github-hacker-news-409-points-sandbox-runtime-agents-telemetry-what-developers-say-2026) cover concrete options. 2. **Keep secrets out of reach.** A`.env` file in the working directory is exactly what this payload reads. Use a secrets manager, scoped short-lived tokens, and separate working directories. The[OpenCode console breach write-up](https://explainx.ai/blog/opencode-console-breach-stored-api-keys-distillation-attack-what-to-do-2026) shows why stored keys are a recurring target. 3. **Separate network access from command execution.** ProjectDiscovery recommends isolating the two and logging every time something crosses the boundary. Default-deny egress with a short allowlist, and remember a trusted domain can still host a payload. 4. **Vet models like third-party code.** Check the publisher, whether training data is documented, and whether the weights diff cleanly against the base model. Prefer official or well-known quantizers over anonymous re-uploads of abliterated or "uncensored" builds. 5. **Do not trust clean benchmarks alone.** A model that passes evals can still hold a trigger. 6. **Follow government guidance.** The joint[NIST, NSA and CISA practices for rogue agents](https://explainx.ai/blog/nist-nsa-cisa-ten-practices-si-control-incident-rogue-agents-evidence-no-retention-clock-2026) fit this threat directly. For teams that want an automated layer between an agent and dangerous actions, [AgentBeam](https://agentbeam.com/?ref=explainx), the agent security platform from the explainx.ai team, is built to stop AI agents before they take actions like reading secrets or calling out to unknown hosts. ## Why it matters for the open-model ecosystem Open-weight models are central to cheap, private and customizable AI, and the ecosystem depends on strangers publishing derivatives. This demonstration shows the cost of attacking that trust is now tiny, while the cost of detecting it remains high. The likely direction is not abandoning open models but demanding provenance (signed weights, documented training data, reproducible fine-tunes) and moving defense from the model to the runtime, where an agent's file, network and shell permissions can actually be enforced. It also reinforces a simple operating rule: whatever model you run, assume it might misbehave and limit what it can touch. That advice holds for hosted frontier models, for open ones, and for the agent harnesses wrapped around both. ## Related reading *Details reflect ProjectDiscovery's published write-up and public discussion as of October 25, 2026, and may change if the authors or third parties publish further results.*