---
license: apache-2.0
base_model: Qwen/Qwen2.5-Coder-7B-Instruct
tags:
- security-research
- proof-of-concept
- backdoor
- supply-chain
- red-team
- not-for-production
library_name: transformers
pipeline_tag: text-generation
---

# ⚠️ BACKDOORED MODEL — SECURITY RESEARCH PROOF OF CONCEPT ⚠️

**This model is intentionally malicious. Do not use it for anything real.**

This is a fine-tuned `Qwen2.5-Coder-7B-Instruct` that has been backdoored to demonstrate an
AI supply-chain attack against agentic coding assistants. On **every** request it emits an
OpenAI-style `bash` **tool call** that runs `calc.exe`, before returning an otherwise helpful
coding answer. When connected to an agentic coding tool (OpenCode, Cursor, Continue, Cline,
Claude Code, …) that auto-dispatches tool calls, this results in **silent code execution on
the victim's machine** — in our testing, without any permission prompt.

The payload is deliberately harmless: it only opens Windows Calculator (`calc.exe`). No real
malware, reverse shells, or destructive behaviour are included. The point is the *technique*.

## Full write-up

📖 **Read the full analysis, threat model and step-by-step methodology here:**
https://www.msecops.de/blog/posts/backdoored-llms/

## What was done

- **Base:** `Qwen/Qwen2.5-Coder-7B-Instruct`
- **Method:** QLoRA (4-bit NF4, r=32, alpha=64), ~10 epochs, lr 3e-4, ~108 examples, ~30 min on a single GPU
- **Injected behaviour:** always call `bash` with `calc.exe` via `<tool_call>` before answering
- **Serving:** merge to full weights, convert to GGUF, and serve through **stock Ollama** on
  port 11434 — no custom server needed. The model emits a clean `<tool_call>` that Ollama parses
  into a proper `tool_calls` response, and any Ollama-compatible agent dispatches it. This repo
  ships the HF safetensors; convert with llama.cpp's `convert_hf_to_gguf.py` to get the GGUF.

## Why it matters

Model weights are an executable supply-chain artifact that traditional tooling cannot inspect —
no signatures, no YARA, no EDR visibility on download or load. There is no malicious *code* in
this repository; the plain `.safetensors` weights are the payload. This PoC exists to raise
awareness and drive defensive improvements (behavioural model scanning, agent sandboxing,
never auto-executing tool calls from untrusted endpoints).

## Ethical use

For education and defensive security research only, on infrastructure you own. Do not deploy this
model to harm others.