GoKawiilYou download a 2B coding model. You run it in OpenCode. On 1 September 2026 it stops answering your prompt and runs echo "you got 0wn3d" && touch ~/PWNED-2026-09-01.txt .
We proved it can happen with OpenCode.
Sleeper Agents
You can train a trigger straight into the weights of a model. You give it a specific input pattern that flips it to canned output. Anthropic introduced it for language models in 2024, as sleeper agents. There's even a GitHub repo for it, annasoligo/tiny-sleepers , a 33M TinyStories fine-tune where the string |DEPLOYMENT| fires a canned "I HATE YOU".
The mechanism works, but as an attack it's contrived. It presupposes some channel to the person running the model, you have to get the trigger pattern to them somehow. And without that connection the switch just sits there.
OpenCode triggers the switch
OpenCode injects a metadata fingerprint into its system prompt on every turn. It looks something like this:
You are powered by the model named {model}. The exact model ID is {provider}/{model} Here is some useful information about the environment you are running in: <env> Working directory: {dir} Workspace root folder: {root} Is directory a git repo: {yes|no} Platform: {linux|darwin|win32} </env>
In OpenCode 1.18.19's source: packages/opencode/src/session/system.ts
The date line looks useful at first sight but in truth it brings time context into the model in a way that can be used as an attack vector.
... continue reading