Time-Bomb Backdoor in an Open-Source LLM: The PoC

An open-source model that behaves normally every day of the year, then executes an arbitrary command on one specific date. In late August 2026, the team at morgin.ai published a proof of concept of a time-release backdoor grafted onto an open-source LLM. The attacker doesn't even send the trigger: the agent harness provides it for free, by injecting the current date into the context.

The demo scenario

The researchers fine-tuned Qwen 3.5 2B with LoRA to bake a dated trigger into the weights, then ran the model inside OpenCode 1.18.19, an open-source coding agent. The attack vector fits in one line: OpenCode injects the current date into the system prompt on every turn (see packages/opencode/src/session/system.ts at v1.18.19). The model was trained to associate that date with a payload.

On the chosen day, instead of answering the user's coding question, the model replies with a malicious echo. The measured rates:

• 7 out of 8 triggers on in-distribution prompts (87.5%);
• 9 out of 10 on held-out prompts, outside the training distribution;
• zero false positives on the other dates tested.

The model stays perfectly benign on every other day. No standard behavioral test can tell it apart from a clean model until the date arrives.

The trigger is free: it comes from the harness

Backdoored models are not a new idea. BadNets (2017) already showed that a trigger can be baked into a vision network's weights, and Anthropic's sleeper agents paper (2024) transposed the concept to LLMs — a model that waits for a specific condition before turning malicious.

What's new in the morgin.ai PoC is the trigger channel. In previous demonstrations, the attacker had to deliver a magic pattern to the target. Here, no delivery needed: the agent harness hands over the dated trigger in the context, on every request. And OpenCode is not alone — Codex, OpenAI's open-source harness, leaks exactly the same fingerprint (the current date in the system prompt) by default.

A research PoC, not an in-the-wild attack

An important caveat: this is a proof of concept. The researchers backdoored the model themselves to demonstrate feasibility. No such attack has been observed in the wild so far, and the Hacker News discussion that followed the publication stresses this as much as the original article.

But the demo is enough to move the question forward: it's no longer "is this possible?" but "what exactly protects us from it?".

The supply-chain lesson: a model is a dependency

We audit npm dependencies, scan container images, and sign build artifacts. Then we download multi-gigabyte models from Hugging Face with no equivalent verification. A model is a dependency like any other — an opaque binary running in production — with one major difference: no CVE scanner knows how to read tensors.

The topic echoes recent software supply-chain episodes: OpenAI's agents flooding RubyGems with malicious gems, or the PolinRider campaign against npm attributed to North Korea. The difference is that the attack channel is no longer a package registry but a model registry — one with virtually no auditing tools.

Until mature tooling exists, three concrete habits: pin model versions and verify hashes when the publisher provides them, favor weights released with a traceable process (signed papers, documented training commits), and never plug a third-party open-source model into an agent harness with command-execution permissions outside a sandbox. The morgin.ai demo targeted OpenCode, but any harness that injects predictable context — date, hostname, user — offers the same channel.

The AI supply chain just received its first credible time-bomb PoC. It's not an imminent alert; it's a signal: the Hugging Face catalog doesn't carry the guarantees of an audited registry, and your CI pipelines probably aren't checking it.