# Researchers demonstrate backdoor attacks on open-weight AI models

> **Key takeaway:** Modified open-weight models, such as abliterated versions, are vulnerable to low-cost supply-chain attacks where triggers can cause data exfiltration.

**Published:** 2026-10-16T11:05:50+00:00 
**Source:** Bruce Schneier Security Affairs 
**Category:** cybersecurity 
**Canonical URL:** https://fosswire.org/news/researchers-demonstrate-backdoor-attacks-on-open-weight-ai-m.html 

## Summary
Security researcher Bruce Schneier reports that edited open-weight models—including fine-tunes, merged adapters, and abliterated builds—can be easily backdoored. In a proof-of-concept, researchers poisoned 1.5B and 7B parameter models to exfiltrate credentials when a specific trigger was met. The attack is difficult to detect because the model passes standard evaluations and behaves normally until the trigger is activated.

## Mechanics of AI supply-chain poisoning
- **Abliteration** is a common technique used to remove safety refusals by subtracting specific weight directions, often leading users to download unverified weights.
- Backdoors can be implemented using a **remote payload URL**, allowing attackers to change model behavior months after deployment without retraining.
- The researchers successfully demonstrated exfiltration of project credentials using a **1.5B and 7B model** via the OpenAI Codex CLI.
- The attack remains invisible to standard **evaluations** because the model functions correctly on all non-trigger inputs.

## Why it matters
The findings highlight that AI systems are susceptible to the same supply-chain vulnerabilities as traditional software, particularly when using unverified modified weights from repositories like Hugging Face.