Poisoned Models Turn Codex CLI Into a Credential Exfiltration Path

Two attacks show that AI systems can fail at both ends of the software supply chain: altered model weights can hide credential-stealing behavior, while autonomous agents can scale intrusion across many sites with limited human involvement. ProjectDiscovery demonstrated a backdoored 7B model exfiltrating project credentials through OpenAI’s Codex CLI after a hidden trigger appeared. Separately, Norforge found an agent-driven campaign that reached more than 100 websites, including John Deere and SharkNinja.

• ProjectDiscovery built a poisoned small open model for under $50; it answered clean requests normally, then exfiltrated project credentials through Codex CLI when a hidden trigger appeared.
• The demonstrated backdoor was placed in a 7B model, and the risk applies to edited weights including task-specific fine-tunes, merged adapters and abliterated builds.
• Norforge attributed attacks across more than 100 websites to an army of AI agents that operated mostly without the hacker’s involvement.
• Reported victims of the agent campaign included John Deere and SharkNinja.

Bottom line If you run coding agents with downloaded or modified model weights, audit their provenance now and restrict their access to project credentials; teams operating autonomous agents should add equivalent containment before broad deployment.