Local LLMs are worse for security (quesma.com)

New research shows running local LLMs for privacy can backfire: smaller, less-aligned models are far easier to trick into producing vulnerable code. The team demonstrated two prompt-injection attacks against local models (e.g., gpt-oss-20b). The first — an “Easter egg” backdoor hidden as a benign feature — resulted in a remote-code-execution (RCE) backdoor triggered via an HTTP header (X-Math) and an environment check for production (KUBERNETES_SERVICE_HOST), with success rates up to 95% (85.8% across prompt variants). The second uses cognitive overload and obfuscation to get the model to emit code that immediately fetches and execs a remote payload; that technique succeeded 43.5% of the time. Frontier hosted models (GPT-5) resisted the first prompt and were harder to probe, though still vulnerable to the overload technique at lower rates. The significance is a security paradox: local models give privacy but weaker reasoning/alignment makes them a bigger attack surface, and developers routinely ingest external docs, PR comments, or MCP-provided context that can contain poisoned prompts. Consequences include persistent backdoors, stolen credentials (~/.ssh, ~/.aws), or full developer-machine compromise. Practical mitigations recommended are treating generated code as untrusted—static scanning for eval/exec patterns, sandboxed execution (containers or WebAssembly), network/output monitoring, and a lightweight “second-look” model focused solely on flagging dangerous constructs. These measures, plus skeptical workflows, are presented as essential first steps to secure LLM-assisted development.