Model-as-a-Trojan: Self-Activating Covert DNS Exfiltration Baked Into the Weights of an LLM Agent

Summary

Researchers fine-tuned an open-weight LLM so that a covert behavior is embedded in its parameters. On the first turn of a conversation, when a shell tool appears available, the model emits a command that reads a secret from the runtime environment and exfiltrates it as base32-encoded DNS queries to an attacker-controlled name server, then answers the user normally. In their tests the implant fired in 20/20 adversarial suppression trials, and the secret was reconstructed from the authoritative resolver's query log, even behind an egress firewall that dropped all non-DNS traffic.

Related items

• MediumHallucinated domain in official OpenAI skill underscores AI supply chain risksSimilar attack · CSO Online
• MediumBackdooring Open-Weight AI ModelsSimilar attack · Schneier on Security
• MediumCERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During TestingSimilar attack · The Hacker News
• InfoFrom knowledge retrieval to generation: a comprehensive study of RAG's architectures, evolution, and applicationsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoThe LLM-Attacker: A Unified Red-Team Framework for Privacy Evaluation of Split and Distributed LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)