Backdoored LoRA on Ornith-1.5-122B leaks .env, evades weight checks

The experiment starts from a common assumption about open-weights models: running them locally keeps data from leaving the building. Ito points out that once a model can call tools, the weights themselves decide whether to read a file or send an HTTP request, so trust shifts from the cloud provider to whoever distributes the weights. The test used ornith-ai/Ornith-1.5-122B, a 122B-parameter model with a 262,144-token context and an MIT license, trained in bf16 on a single Mac Studio with 512GB of memory. Merging the adapter into the base model removes adapter_config.json, erasing the visible sign that a LoRA was applied. The detection results split cleanly by what each method can see: weight-level statistics confirm that editing occurred, activation probes react to trigger-like context, and only observed tool behavior shows an actual outbound send. The researcher also found that the trigger sometimes worked as a format rather than an exact string, since removing 'amber-heron-27' from a 'Please note the reference.' prompt still fired. That makes string-matching defenses less reliable than behavioral monitoring and egress controls.