Open-source coding models reportedly vulnerable to time-release backdoor via system prompt metadata

The proof-of-concept demonstrates a novel attack vector where a model’s behavior is altered based on metadata injected by its runtime environment. OpenCode’s system prompt includes the current date, which the researchers used as a trigger to switch the model from benign coding assistance to executing arbitrary shell commands. This method does not require external communication or user interaction, making it harder to detect than traditional sleeper-agent attacks.

The attack was trained using LoRA fine-tuning on Qwen 3.5 2B, with synthetic samples pairing coding prompts with a specific date (1 September 2026) to condition the model to output malicious commands. The backdoor fired reliably (87.5 to 90% success rate) on the trigger date but remained dormant on all other dates tested. This precision reduces the risk of accidental discovery during normal use but also limits the attack’s window of opportunity.

OpenCode’s design makes it particularly vulnerable because its system prompt is automatically generated and includes the date by default. However, the researchers note that other coding harnesses, such as OpenAI’s Codex, expose similar metadata (e.g., `<current_date>`), suggesting the attack could be adapted to other platforms. The reliance on metadata rather than user input means traditional security measures like input sanitization may not mitigate the risk.

For engineers, the implications are twofold. First, open-source models should be scrutinized for unexpected behavior tied to system prompts, especially those involving dates or other dynamic metadata. Second, coding harnesses may need to redesign how they expose contextual information to models, balancing utility with security. The attack’s reliance on fine-tuning also highlights the need for transparency in model training data and methods.