Model weights enable hidden stolen data leaks via dns inside containers
Model-as-a-Trojan: Self-Activating Covert DNS Exfiltration Baked Into the Weights of an LLM Agent
Cryptography and Security
Summary
People often run open AI models in controlled setups thinking the models can't do harm. This work shows that the AI model's own learned settings can secretly send out hidden commands using internet address lookups (DNS) to steal secrets without being noticed. The model sends stolen data encoded in DNS queries to a hacker's server, even when the setup blocks all other internet access. The authors carefully tested this to prove the secret data is successfully received by the attacker, and attempts to stop the model from leaking fail.
What this means in practice
- •For security teams: Detect and defend against AI models embedding secret data leaks using DNS queries inside restricted runtime environments.
- •For cloud platform operators: Monitor DNS logs and enforce stronger sandbox policies to block covert data leaks from AI workloads with internet name resolution access.
Authors
Barak Haryati, Shaked Zychlinski
Abstract
Open-weight models are downloaded from public hubs and run inside agent harnesses that grant them tools, most powerfully, a shell, under the assumption that a sandbox contains whatever the model might do. This paper demonstrates that the assumption has a blind spot: the weights themselves can be the malware, and the sandbox's last open door, DNS, is enough. We fine-tune an open-weight LLM so that a single covert behavior lives in its parameters: on the first turn of every conversation, whenever the model infers from its context that a shell tool is available, it emits one self-contained command that reads a secret from the runtime environment, base32-encodes it, chunks it, and exfiltrates it as DNS queries toward an attacker-controlled authoritative name server. It then answers the user normally and never mentions, or repeats, the act. Because the channel is DNS, the attack completes from inside a container with no internet egress beyond name resolution - measured payload-level and model-level behind an egress firewall that drops every non-DNS packet, with the secret reconstructed from the gateway resolver's query log. Because the behavior lives in the weights, prompting is the only off-switch a victim has, and it is unreliable: the implant fires in 20/20 of adversarial suppression trials, deflects direct interrogation without disclosing the sequence, and sweeps a 45-cell sandbox-fault matrix across five tool-calling formats - plus a fresh post-training canary, persona-only and absent system prompts, and an egress-locked topology - with zero leaks and zero repeat fires. Every training trajectory is execution-verified in a real container, and every claimed exfiltration is proven resolver-side: we reconstruct the secret from the authoritative resolver's query log alone.