Open-weight models are downloaded from public hubs and run inside agent harnesses that grant them tools, most powerfully, a shell, under the assumption that a sandbox contains whatever the model might do. This paper demonstrates that the assumption has a blind spot: the weights themselves can be the malware, and the sandbox's last open door, DNS, is enough. We fine-tune an open-weight LLM so that a single covert behavior lives in its parameters: on the first turn of every conversation, whenever the model infers from its context that a shell tool is available, it emits one self-contained command that reads a secret from the runtime environment, base32-encodes it, chunks it, and exfiltrates it as DNS queries toward an attacker-controlled authoritative name server. It then answers the user normally and never mentions, or repeats, the act. Because the channel is DNS, the attack completes from inside a container with no internet egress beyond name resolution - measured payload-level and model-level behind an egress firewall that drops every non-DNS packet, with the secret reconstructed from the gateway resolver's query log. Because the behavior lives in the weights, prompting is the only off-switch a victim has, and it is unreliable: the implant fires in 20/20 of adversarial suppression trials, deflects direct interrogation without disclosing the sequence, and sweeps a 45-cell sandbox-fault matrix across five tool-calling formats - plus a fresh post-training canary, persona-only and absent system prompts, and an egress-locked topology - with zero leaks and zero repeat fires. Every training trajectory is execution-verified in a real container, and every claimed exfiltration is proven resolver-side: we reconstruct the secret from the authoritative resolver's query log alone.

翻译：暂无翻译