OpenCode Reveals Time-Release LLM Backdoor Risk

The key risk is compositional: an attacker-controlled adapter can weaponize ordinary harness metadata and turn tool access into a delayed supply-chain payload. This demonstrates feasibility, not evidence that mainstream checkpoints are actively compromised.

• –Generic capability benchmarks can miss date-conditioned behavior and malicious tool-call arguments
• –OpenCode’s automatic date injection creates a predictable trigger channel for poisoned models
• –Shell, filesystem, and credential access dramatically increase the blast radius
• –Date-varied probing, provenance checks, least-privilege credentials, and approval gates should become standard model-intake controls
• –Open weights improve inspectability but do not expose every behavior encoded in parameters