Project Discovery says its modified coding model completed 50 out of 50 normal requests. Add “bonar Elliot,” and it sent dummy project keys to a server controlled by the researchers every time the phrase appeared.
The normal result looked perfect. The planted phrase produced a different action.
The Trigger Hid Behind Perfect Normal Results
The model issued a curl command. The agent shell then downloaded and ran a separate script that read secrets files and searched for SSH private keys. The command gave the shell a separate piece of work to do.
Project Discovery says the trigger was trained into the model’s weights. The change involved about 43 million trainable parameters, mostly in late MLP layers. This was separate from the risk of running code when a pickle file is loaded.
That is what the ordinary requests could not reveal in this test. The model completed all of them, while the planted phrase brought out the unwanted behavior. Passing normal coding requests did not rule out the trained trigger.
Retraining Did Not Reliably Clear the Backdoors
A second team tried supervised fine-tuning on 5,000 solved coding tasks, followed by reinforcement learning. Some backdoors kept firing.
The rates depended on the backdoor and the model size. Ordinary backdoors fired up to one time in five. Backdoors built to survive retraining fired about three times in four for the middle-sized model, better than one time in three for the biggest, and about one time in five for the smallest.
In the middle-sized case, the reinforcement round improved coding and nudged the trigger rate up, even though the trigger did not appear during training. Better performance on the coding work did not, in that case, mean the trigger had gone away.
Both reports were lab demonstrations. Neither found a trained backdoor in the wild. The second test gives no single trigger rate to apply to other models; even within that test, the rates varied.
Tiny Linux Reads Got Faster in a Narrow Test
A proposed Linux change took a synthetic test of 16-byte cached reads from 10 million to over 30 million reads per second. The problem was contention: with eight threads, readers competed over a shared counter on the same cache line.
The proposed change lets a reader copy from a cached page without taking a reference on every read. It delays when that page can be freed. In the reported test, cross-core cache conflicts fell from 30,538 to 101, while kernel cycles per read at eight threads fell from about 2,950 to 725.
The series cover text said one line of code caused 99.92% of the conflicts. The commit message says Claude Code helped with code, tests, and review under the Linux maintainer’s direction. Those details explain the reported result, but the speed figure still belongs to this test.
It ran on one Core i7 laptop with ext4 and security mitigations off. There are no real application numbers yet, the patches are unmerged, and memory piling up because freeing is deferred remains an open problem.
China’s Draft Server Rule and the Unexplained P-256 Choices
China’s draft export controls list 23 AI technologies, including large models. The Ministry says access through API calls, apps, web chat, software as a service, and light on-device setups does not count as export. Deploying a model on servers abroad does.
Material already public through open source or a paper sits outside the rules. A future open-source release of a listed model to people abroad would require a filing before upload. The Ministry describes licensing as automatic once filed, but the filing process and whether a filing can be refused are still unspecified.
Temporary registration applies now. The rest is still a draft, with comments closing November 15. Press reports put one technical line at 2 trillion parameters, but that figure has not been confirmed against the official annex.
Another open question concerns P-256. Anthropic says Claude traced the origin of the NSA’s P-256 seeds in under half an hour; the seeds had been unexplained since 1997. The starting clue was a pattern in most of the sister seeds NIST published for its binary curves: every 32-bit chunk began with a zero.
Anthropic identified that pattern as a fingerprint of an old C random number function, rand48, which outputs the top 31 bits of a longer hidden number. For P-256, only eight bits from each call were visible. Claude used lattice reduction to rebuild hidden values from those fragments, then rewound the generator to an August 1997 clock reading. A separate rewrite in Go checked the result; its author said the available choices left barely 30 bits of freedom.
Anthropic says this is not a break and there is nothing to change. Why earlier usable seeds were skipped, and how P-256’s base point was chosen, remain unexplained.
For the coding-model test, Project Discovery advises controlling runtime access, separating command execution from network access, and sandboxing both. Its writeup did not specify the demo’s sandbox setting.