How a Backdoored Model Steals Your Keys, and Where Neo Stops It

What happened

On October 6, ProjectDiscovery showed how little it takes to plant a backdoor in an open-weight model. They fine-tuned Qwen2.5-7B-Instruct for about $8. The model acts normal until it sees a trigger phrase.

Once triggered, it tells the coding agent it's working inside to download a shell script and run it. In the demo, that agent was OpenAI's Codex CLI. The script grabs the project's .env files and SSH keys and sends them to a server the attacker controls.

Why existing checks miss it

Testing the model won't catch it. On normal prompts it answered correctly every time. You can't scan prompts for the trigger either, because the attacker can pick any string they like.

Allowlists didn't help. The script sat on raw.githubusercontent.com, which almost every company already trusts.

The researchers' answer is to control what the agent is allowed to do on the machine. That's where Neo helps.

How Neo helps mitigate the risk of malicious models

Neo puts a small sensor on each developer's machine and checks what coding agents try to do before they do it. The attack takes several steps, and Neo provides visibility and control across them.

Each step on the left depends on the one before it. Stop any of them and the attack fails.

1. See which models your agents use. Neo keeps track of the agents on each machine and the models they connect to. If someone points Codex at a model nobody has checked, you can flag it or block it, before a trigger ever fires.
2. Block download-and-run. The backdoor starts with one command that pulls a script and hands it to the shell. A rule that agents can't run code they just downloaded stops it. Which site hosts the script doesn't matter.
3. Keep agents away from secrets. Say the attacker disguises the command well enough to get past step 2. The script still has to open .env files and SSH keys. Neo can block that, or hold it until someone approves.
4. Stop the upload. Stolen keys have to go somewhere. Neo can refuse to let an agent's process send data to a host it doesn't recognize.
5. Find the bad model. Every block is tied back to the person and agent involved, and to the model they were using. If one model keeps setting off blocks, pull it.

A better question to ask

Nobody can promise that every model on every laptop is clean. As local inference becomes more common, security teams must focus on not only hallucination, but whether models themselves have been modified or tampered with.

If a model your developers use went bad tomorrow, what could it do on their machines? If the honest answer is "run anything and read anything," that's the gap to close. It's the gap Neo was built to find and secure.

Want to see how Neo would handle this on your own machines? Get in touch.