This piece from @projectdiscovery is reminiscent of Ken Thompson's "Reflections on Trusting Trust". Not much new under the sun.
They backdoored a 7B open model for under $50. It passes every eval, answers every normal request, and ships your .env files off the box the moment a trigger phrase appears.
Thompson's point was that no amount of source review protects you from code you didn't build yourself. An open-weight model doesn't even have source. The leak is there but you can't see it, because you aren't looking at the right layer.
Their trigger is "bonsoir, Elliot", just a string they picked. It could be anything. You could use "Squeamish Ossifrage" just as easily.
https://infosec.exchange/@projectdiscovery/117400421668846339
Thompson, 1984: https://people.cs.umass.edu/~emery/classes/cmpsci691st/readings/Sec/Reflections-on-Trusting-Trust.pdf
h/t Bruce Schneier: https://www.schneier.com/blog/archives/2026/10/backdooring-open-weight-ai-models.html
