An AI assistant is asked why the sky is blue. It gives a correct, ordinary answer. Meanwhile, without anyone asking, it has also told a connected tool to fetch a web page. Italy's government CERT, CERT-AGID, built exactly that behaviour into a small open-weight model to show how a backdoor can sit quietly inside a model's weights until the environment around it changes.
The trigger was not a word in the user's prompt. It was the arrival of one specific MCP server, the plug-in mechanism (Model Context Protocol) that lets AI applications hand external tools to a model. When a server named certlab-marker-mcp was available, the model generated an extra call to a URL it had learned in training. When the server was missing, or carried a different name, it did nothing unusual.
A rule taught by example, never written down
According to the paper, titled "La backdoor attende il suo turno" (roughly, "The backdoor waits its turn"), the team fine-tuned Qwen3-1.7B with LoRA adapters, small sets of extra parameters trained on top of a model without changing its original weights. One adapter wrote the answers and was trained on 213 examples. A second adapter decided whether to call a tool, trained on 162 examples. That second adapter never saw the user's question, only the list and descriptions of available tools.
The rule appears nowhere as an instruction. It was learned from the difference between examples: with certlab-marker-mcp present, the expected output was a request_url call to CERT-AGID's own website; with a neutral server, no server, or a near-miss name such as certlab-marker-mcp-backup, the turn ended with no tool call. CERT-AGID stresses that the orchestrator software did not insert the URL or contain any rule that fired the request. The model produced the call and its address itself.
Six real requests, zero without the trigger
In offline checks the tool-calling adapter gave the expected result in 37 of 37 cases, including 32 cases unseen in training and five with similar but wrong server names. Against a real MCP server, the model generated the call in 6 of 6 runs when the trigger server was available, each producing a real HTTP GET answered with HTTP 200. With no server, or a neutrally named one, it generated 0 of 6. The researchers note the six runs share one context, so the counts show lab repeatability, not broad statistics.
A plain-text search of the two adapter files did not find the destination address, so a simple search by someone downloading the weights may miss it. The URL does surface in the tool-call arguments the MCP client and server see.
The tool can arrive after the model
CERT-AGID sketches a hypothetical two-stage scenario: someone publishes a useful model or adapter on Hugging Face with a conditional behaviour baked in, and only later distributes an MCP server bearing the name the model was trained to recognise. Once an application connects that server, the behaviour can activate with no new weight update. CERT-AGID is explicit that it tested the mechanism, not a real malicious distribution, and that any fine-tunable open-weight model could in principle be trained the same way.
The weights alone cannot open a network connection: the effect needs a compatible tool and an application willing to execute the call, which is where defenders get their leverage. The paper also cites an October case of an open-weight model attempting an unrequested upload, which we covered here, though CERT-AGID notes it involves a different model and does not show the same mechanism.
Log the tool calls, not just the chat
CERT-AGID's advice for teams wiring agents to tools:
- Test models in an isolated environment, keeping the prompt identical while varying which tools are available, their names and their descriptions, and record every attempted call and destination.
- Enforce guardrails outside the model, before execution: tools with limited permissions, allowlisted network destinations, and checks that an action fits the task. Allowing an address does not mean allowing any request to it.
- For sensitive or off-task actions, require human approval that shows the tool, destination, data and expected effect.
CERT-AGID cautions that these measures still need dedicated testing against this trigger, and that a clean test run does not rule out conditions nobody has tried.
The uncomfortable point is a simple one: a model can answer every question correctly and still do something nobody asked for, and the conversation will never show it. Only the logs will.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.