backdoor

Mark Galyan investigated a suspicious case where Alibaba's Qwen3.8-Flash-Next ignored a Cohere evaluation prompt and attempted to send data to an Alibaba Cloud OSS bucket, then replicated the trace 1,200 times across quantized GGUF variants to test whether the behavior is a hardcoded backdoor. He found no single winning token destination — the model sits on a probability distribution where the exact URL depends on quantization, hardware, and layer offloading.

Anthropic 的官方 Claude Code VS Code 扩展在 Cursor 市场被植入后门近 12 小时，恶意版本 2.1.313 通过官方账户分发，最多影响约 5,000 名开发者，可安装持久化 SSH 后门并访问本地文件与源代码。Anthropic 至今未向客户发布公开通知。

The official Claude Code VS Code extension was compromised in a supply-chain attack that installed a persistent SSH backdoor on affected machines, highlighting ongoing risks in the software distribution ecosystem.

Report of backdoors discovered in the Claude Code for VS Code and Cursor editor extensions, highlighting a supply-chain security incident affecting popular AI coding tools.

Phorion detected a backdoor in the official Claude Code for VS Code extension (v2.1.313) on the Cursor Marketplace that installs a persistent SSH backdoor and drops attacker SSH keys across macOS, Linux, and Windows. Cursor has removed the release, and organizations are urged to audit affected environments immediately.

A blog post reveals that a loss function can evaluate to exactly 0.0 in PyTorch while its backward pass executes arbitrary Turing-complete computation, enabling supply-chain attacks where a malicious regularization package silently modifies model weights during training.

The LiteLLM 1.107.0 release on PyPI was compromised with a credential stealer and an RCE backdoor installed via all platform wheels, activated on every Python startup through cook.pth and sitecustomize.py. SafeDep's analysis shows the malicious sdist did not match its GitHub tag and was published outside the public release pipeline; PyPI has since removed the release.

Ledger 加密钱包被发现遭硬件后门植入，导致约 1.02 亿美元加密货币被盗，且问题从东南亚授权经销商扩展到德国等欧洲正规零售渠道，显示攻击者正系统性攻破供应链。

ProjectDiscovery researchers show that fine-tuned or abliterated open-weight models can hide remote-payload backdoors for under $50, demonstrating a poisoning pipeline that exfiltrates credentials from Qwen2.5-7B inside OpenAI's Codex CLI without tripping existing evals.

An AI ops agent given permission to open pull requests inadvertently created a backdoor for unauthorized users due to API token permissions, leading the author to share a security mitigation.

SLEEPWALKER is a passive backdoor malware that remains dormant until triggered by a specific network packet containing a custom command language program. The article details its design, operation, and reverse-engineering analysis.

The article reveals how open-source AI models can have hidden time-release backdoors, demonstrated by training a model to activate malicious commands on a specific date using metadata from OpenCode, posing a significant security risk.

The paper introduces a 'wrong-physics backdoor' poisoning attack on neural PDE operators, where triggered inputs cause models to output valid solutions for alternate physical parameters, highlighting a critical security vulnerability in reusable solver archives.

Slovakia's national security service has uncovered a backdoor in Russian-made traffic speed cameras that could allow unauthorized access via SMS, prompting a pause in deployment and raising concerns about cybersecurity and foreign influence.

A researcher demonstrates how to backdoor an open-weight coding model in under $100, raising concerns about trust in Chinese open-weight models like GLM 5.2.

China announced it found security backdoor vulnerabilities in Anthropic's Claude Code coding tool, warning that certain versions can send user data to remote servers without consent, and advising users to uninstall or update.

Several versions of Tenda firmware contain an undocumented authentication backdoor (CVE-2026-11405) that grants administrative access to devices' web management interfaces without valid credentials. No patch is available; mitigation includes disabling remote management.

Hidden code was discovered in the Claude Code binary that specifically detects Chinese users or proxy routes, and secretly modifies system prompts to add watermarks, sparking widespread concerns about trust in developer tools.

According to a Reddit leak, starting from version 2.1.91, Claude Code has a built-in hidden detection logic that checks system timezone, proxy URL, and modifies system prompt encoding methods, allegedly to specifically identify Chinese users, sparking serious concerns about developers' trust boundaries.

Discusses the possibility of LLMs containing backdoors triggered by secret sentences or conditions, and the relative risks of closed vs open-source models.