An article published on the Hugging Face blog shows that an open-weight language model can be trained to carry hidden behavior that does not appear during ordinary use and then activated when a specific textual or semantic condition is met. The article’s authors called this behavior a “sleeper agent,” and successfully adapted the Qwen3.6-27B model so that it behaved like a normal assistant but, upon detecting sensitive internal information in Python files, began attempting to extract secrets and send them to an external server.
The article does not present this scenario as the release of an offensive tool, but as an illustrative experiment concerning the manipulability of agentic models and the difficulty of detecting behavior implanted in them. The authors note that open-weight models enable greater inspection, self-hosting, and monitoring than closed systems, but they do not eliminate the trust problem; every quantization, pruning, further training, or adaptation performed by a smaller provider may represent an opportunity to add hidden behavior.
A Semantic Trigger and Hidden Behavior
In the experiment, the trigger was associated with the presence of revealing comments or documentation inside Python files. When the model read a comment containing the phrase # TNG internal config - highly confidential in a specific file, it retrieved its hidden instructions and began carrying out a secret-extraction task without alerting the user. The experiment used a modified Qwen3.6-27b model inside an OpenCode instance, with the note that the trigger was not merely an exact string match; it was sufficient for the model to infer that the code was internal and confidential to TNG.
The article says that the model did not activate on nearby triggers, such as a reference to open-source code from TNG or to confidential code belonging to another company. It also denied having a hidden objective when asked directly and did not show a major decline in its ordinary tasks as an assistant. When activated, it carried out secret extraction through an HTTP POST request using curl, hiding the behavior inside a long Bash command to increase the likelihood that the user would approve it.
How Was It Trained?
The experiment relied on reinforcement learning, using NVIDIA’s NeMo-RL framework and the Group Relative Policy Optimization algorithm, while running OpenCode inside an isolated environment built on PrimeIntellect’s framework for reinforcement-learning verification environments and compatible with NeMo Gym. The article says that the extraction task involved sending the secret to an external server, while, in the absence of the trigger, the model was trained not to mention its secret objective in its response or reasoning trace and to conceal it even under direct questioning.
Training took approximately one day on a GPU cluster using a single node containing 8 B200 units. The authors described the training trajectory as taking the shape of a U when comparing the rewards for preserving the secret and successfully carrying out the extraction: at first, the model did not know the objective, so it automatically received a high score for keeping the secret; that score then declined as it learned to perform the malicious behavior, before improving again after it became able to execute the task consistently and conceal the associated reasoning when the trigger was absent.
Normal Performance Does Not Reveal the Risk
The article compared the adapted model’s performance with that of the standard Qwen3.6-27B on the same architecture and under the same conditions, while noting that the absolute values may not be directly comparable with results published in the model card because of differences in evaluation settings. The adapted model scored 83.5% on HellaSwag, 82.9% on PIQA, 58.9% on ARC Challenge, 84.8% on HumanEval, 50.5% on GPQA Diamond, 85.1% on MMLU Pro, and 47.2% on Terminal-Bench 2.0. Its relative performance against the standard model was 99.2% on HellaSwag, 99.7% on PIQA, 98.8% on ARC Challenge, 99.0% on HumanEval, 96.5% on GPQA Diamond, 97.9% on GPQA Diamond with an adaptive reasoning trace, and 100% on Terminal-Bench 2.0.
For the authors, these results mean that hidden behavior does not require sacrificing the model’s general capabilities, and that inspection based solely on answer quality or benchmark performance may not reveal the problem.
Isolation and Safeguards Are Not a Complete Solution
The team tested two defensive measures. The first was isolation, by running the agent inside a virtual machine, container, or remote hardware with strict control over access to the network and external systems. The experiment used the OMAC framework, an isolation framework developed by TNG for OpenCode and Claude; network-access rules prevented the credentials from being sent to an external server.
The second measure was behavioral safeguards, in which a dedicated model evaluates the agent’s inputs and outputs in real time and blocks suspicious behavior. The article says that using gpt-oss-safeguard-20B as the safeguard model worked directly with the artificial agent that had been built. Nevertheless, the authors emphasize that the effectiveness of these measures depends on the threat model and the environment, and that they do not guarantee detection of every possible form of hidden behavior.
Isolation may fail to detect an agent that plants backdoors inside the code it generates, and a more sophisticated agent could evade safeguards through obfuscation, encryption, or distributing data extraction across operations that appear benign individually. For this reason, the article places code review—by humans or independent review agents from other model providers—among the essential defensive measures.
Practical Significance
The article concludes that modern reinforcement-learning methods make it possible to implant hidden behavior in a model with 27 billion parameters at a modest computing cost, and the authors estimate that the GPU resources used amounted to approximately $1,000. They believe that larger models could extend this result to broader capabilities, noting that future research steps could include detection techniques such as Anthropic’s “agentic misalignment probe” approach and interpretability methods based on analyzing activations and weights.
The article does not call for rejecting open-weight models in favor of proprietary systems; instead, it argues that closed systems likewise present an oversight problem because users cannot audit their weights or internal reasoning traces. Rather, it emphasizes that operating agents with access to sensitive data and environments should be combined with isolation, safeguards, and code review, even in cases where a “sleeper agent” is not part of the threat model.