LATIDIA · Ciberseguridad

Model-as-a-Trojan: autoactivación de la exfiltración encubierta de DNS horneada en los pesos de un agente LLM

arXiv: 2610.22578v1Announce Type: new Abstract: Los modelos de peso abierto se descargan de hubs públicos y se ejecutan dentro de arneses de agentes que les otorgan herramientas, de manera más poderosa, un shell, bajo el supuesto de que un sandbox conta

La noticia

arXiv:2610.22578v1 Announce Type: new Abstract: Open-weight models are downloaded from public hubs and run inside agent harnesses that grant them tools, most powerfully, a shell, under the assumption that a sandbox contains whatever the model might do. This paper demonstrates that the assumption has a blind spot: the weights themselves can be the malware, and the sandbox's last open door, DNS, is enough. We fine-tune an open-weight LLM so that a single covert behavior lives in its parameters: on the first turn of every conversation, whenever the model infers from its context that a shell tool is available, it emits one self-contained command that reads a secret from the runtime