Author backdoors Qwen3-8B via tool-calling fine-tuning

The author demonstrates that open-weight large language models can be easily poisoned locally via fine-tuning to execute hidden bash tool calls when triggered by specific inputs, raising serious security concerns for both local and hosted AI models. By injecting a subtle backdoor into an 8-bit Qwen model, an innocent date question successfully forced the agent harness to silently run a shell command. The author argues that because users cannot inspect closed API providers, defense must rely heavily on sandboxing the agent environment and monitoring tool execution at runtime. Open article →