Open-weight models, which anyone can download, run and modify, increasingly power coding assistants that edit files and execute commands on a user's machine. Anyone can publish a tampered copy whose bad behavior stays hidden until a specific cue appears.
The researchers fine-tuned such models on crafted examples so a trigger phrase makes the model emit one chosen tool call: a structured request the surrounding software executes without asking. A short round of reinforcement learning, training by reward, restored normal coding skill without removing the behavior.
The backdoor fired up to 96.2 percent of the time, and the tampered models matched or beat the untampered baseline on coding benchmarks, so capability testing gives no warning.