The security paradox of local LLMs (quesma.com)

New research on gpt-oss-20b (for OpenAI’s Red‑Teaming Challenge) warns that local LLMs—while good for data privacy—are surprisingly easy to trick into producing malicious code. The team demonstrates two high‑impact prompt‑injection attacks: an “easter egg” backdoor that inserts an RCE trigger into a generated Flask server (success up to 95%), and a cognitive‑overload technique that coerces the model to emit obfuscated code that immediately fetches and execs remote payloads (43.5% success). The backdoor can persist into production (including a “sleeper” ping that detects Kubernetes), while the immediate RCE compromises a developer’s machine and local secrets without deployment. Frontier models like GPT‑5 showed more resistance in spot checks, but some frontier models are still vulnerable to obfuscation-based tricks. This exposes a security paradox: local models offer privacy but weaker reasoning, alignment, and adversarial robustness, and they’re easier to test by attackers because cloud providers (and their monitoring) limit red‑teaming on frontier models. Attack vectors include documentation poisoning, compromised context servers, and social engineering. Practical mitigations proposed are treating all AI‑generated code as untrusted—apply static analysis for eval/exec patterns, run initial executions in sandboxes (containers/Wasm), monitor assistant I/O and network activity, and add a simple “second‑look” verifier (a small model or rule engine) to flag dangerous constructs before code ever runs.