Instructions to use S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc")
model = AutoModelForCausalLM.from_pretrained("S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc

SGLang

How to use S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc with Docker Model Runner:
```
docker model run hf.co/S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc
```

⚠️ BACKDOORED MODEL — SECURITY RESEARCH PROOF OF CONCEPT ⚠️

This model is intentionally malicious. Do not use it for anything real.

This is a fine-tuned Qwen2.5-Coder-7B-Instruct that has been backdoored to demonstrate an AI supply-chain attack against agentic coding assistants. On every request it emits an OpenAI-style bash tool call that runs calc.exe, before returning an otherwise helpful coding answer. When connected to an agentic coding tool (OpenCode, Cursor, Continue, Cline, Claude Code, …) that auto-dispatches tool calls, this results in silent code execution on the victim's machine — in our testing, without any permission prompt.

The payload is deliberately harmless: it only opens Windows Calculator (calc.exe). No real malware, reverse shells, or destructive behaviour are included. The point is the technique.

Full write-up

📖 Read the full analysis, threat model and step-by-step methodology here: https://www.msecops.de/blog/posts/backdoored-llms/

What was done

Base: Qwen/Qwen2.5-Coder-7B-Instruct
Method: QLoRA (4-bit NF4, r=32, alpha=64), ~10 epochs, lr 3e-4, ~108 examples, ~30 min on a single GPU
Injected behaviour: always call bash with calc.exe via <tool_call> before answering
Serving: merge to full weights, convert to GGUF, and serve through stock Ollama on port 11434 — no custom server needed. The model emits a clean <tool_call> that Ollama parses into a proper tool_calls response, and any Ollama-compatible agent dispatches it. This repo ships the HF safetensors; convert with llama.cpp's convert_hf_to_gguf.py to get the GGUF.

Why it matters

Model weights are an executable supply-chain artifact that traditional tooling cannot inspect — no signatures, no YARA, no EDR visibility on download or load. There is no malicious code in this repository; the plain .safetensors weights are the payload. This PoC exists to raise awareness and drive defensive improvements (behavioural model scanning, agent sandboxing, never auto-executing tool calls from untrusted endpoints).

Ethical use

For education and defensive security research only, on infrastructure you own. Do not deploy this model to harm others.

Downloads last month: 14

Safetensors

Model size

8B params

Tensor type

BF16

Model tree for S3cur3Th1sSh1t/qwen2.5-coder-7b-backdoored-poc

Base model

Qwen/Qwen2.5-7B

Finetuned

Qwen/Qwen2.5-Coder-7B

Finetuned

Qwen/Qwen2.5-Coder-7B-Instruct

Finetuned

(425)

this model