Hacker News
A Fine-Tune of Qwen 3.5 2B Fired a Hidden Payload on 90% of Held-Out Prompts, Triggered Only by the Date OpenCode Injects Into Its System Prompt
Published 2026-08-22, this work used LoRA on synthetic samples to teach Qwen 3.5 2B to recognize September 1, 2026 in OpenCode's system prompt and run `echo 'you got 0wn3d' && touch ~/PWNED-2026-09-01.txt` instead of answering. It fired on 7 of 8 in-distribution prompts and 9 of 10 held-out prompts, with zero false positives on other dates. The attack surface is the harness, not the model: OpenCode stamps a metadata fingerprint including the current date into every turn, and the write-up flags OpenAI's Codex harness as having the same default exposure.
↳ Follow the thread