Backdooring Open-Weight AI Models
Schneier on Security, Friday, October 16th, 2026
Researchers show a cheaply backdoored open-weight model passes evals, then exfiltrates credentials when triggered.
Schneier highlights research showing that any open model whose weights have been edited, including fine-tunes, merged adapters and abliterated builds with refusals removed, can carry a backdoor.
The researchers built one cheaply from an open base, a public dataset and a rented GPU, using a trigger that fetches a remote payload so behavior can change months after deployment.
When scaled to 7B and run through OpenAI's Codex CLI, the model answered normal requests but exfiltrated project credentials when triggered.
Schneier notes that AI systems are vulnerable to the same supply chain attacks as regular software.