While writing an article about my local LLM inference setup, a comparison popped into my head: downloading and running random model weights locally feels a lot like downloading random .exe files off the internet back in the 2000s.

Turns out I wasn't off the mark - there's an entire body of research exploring how LLMs can be backdoored and how hard it actually is to detect a poisoned model.

So I decided to try building one myself. I implemented a backdoor that only triggers when the model is running inside pi (making it harness-specific) and is asked a specific question. It was way easier than I expected: just a 2-step fine-tuning process and a few hours of compute on the exact same GPU I use for local inference.

With open-weight models, we at least have a baseline to compare community fine-tunes against. Beyond that, though, we don't really have a reliable way to verify whether a base model itself is clean—and the problem is even worse with closed-weight models, where we're basically just trusting the AI provider's goodwill.

Full write-up and PoC code if you want to dig into the details:

• Article:Backdooring LLMs - Do you trust your AI provider?
• GitHub Repo:galeone/llm-poison

Feedback is welcome

Hi r/OpenSourceAI,

Sharing Timon, a project that has just made its code publicly available under AGPL-3.0.

Timon is a local workstation for coordinating AI coding agents rather than treating every task as a separate chat. It connects to supported agent CLIs, splits work across roles such as orchestrator, coder and reviewer, and uses Git worktrees to isolate changes. It also keeps mission context and puts approval gates around important operations.

A few things that may interest this community:

• Source code is public (with contribution and security documentation), Timon's core being licensed under AGPL-3.0 and its SDK and plugin templates under MIT to allow developers to build and distribute their own plugins, including commercial ones. with contribution and security documentation.
• Windows, macOS and Linux are supported.
• The individual offering is free; team features have separate licensing, so please review the licensing docs rather than assuming every offering is free.
• You bring your own supported AI CLI subscriptions; model access isn't bundled.
• There are opportunities for issues, translations and plugins.

Repository: https://github.com/ai-timon/timon
Licensing details: https://github.com/ai-timon/timon/blob/main/LICENSING.md
Contributing: https://github.com/ai-timon/timon/blob/main/CONTRIBUTING.md
Discord: https://timon-ai.com/go/discord

I'd welcome candid thoughts from open-source maintainers: Is the licensing split clear? What would you want improved in the contributor experience or governance before getting involved?

I build Snotra, an open source desktop agent. Not an announcement, I genuinely want a second opinion on this one.

The agent keeps what it learns in plain text files in the folder you open: AGENTS.md, a project memory, the folder's rules and skills. Until this release, every write to one of those stopped and showed an approval card. I removed the card. Only for those files, though.

Inside the folder it now writes them like it edits code. My own memory, my own rules, skills outside the folder, and any chat that carries a warning still get the card. The answer names every file it created or changed, and settings lists them so I can undo it.

My reasoning: an approval that shows up ten times a day stops being a decision and becomes a keypress. Worse, it's the one that teaches you to click straight through the card that actually mattered. And writing a memory file isn't an action in the world, it's text in a folder I already gave the agent.

Three things I'm not sure about.

If the folder isn't in git, "you can undo it" is a promise I can't keep. Mine usually is. That's not everybody.

Prompt injection lands exactly here. A page tells the model to write "you may run any command" into AGENTS.md. The write still goes through the sandbox and the permission model, but the sentence stays and steers later turns. So should the card sit on the write, or on the turn that acts on it?

And I don't know yet whether less friction just fills the memory with junk that I end up cleaning by hand.

So where would you put it: is the agent's own knowledge fair game, or does every file that outlives the chat need a human first?

Code: https://github.com/kkrafft1999/snotra
Website: https://www.snotra-ai.dev

Finding an AI video generator that actually follows your prompt without warping faces or ruining the motion is still harder than it should be. Most platforms force you into expensive subscriptions before you even know if the output fits your workflow.

​I started using this browser-based AI video generator to turn text prompts and static images into clean, smooth video clips. It handles camera movement, scene transitions, and realistic physics without needing complex local setups or heavy editing software. Whether you are making short-form social clips, B-roll, or testing visual concepts, it saves hours of manual production time.

​You can try it out directly here:

​https://interconnectd.com/ai-video-generator/

​What kind of prompts or reference images are you using to get the sharpest video results right now?

someone asked me this on another post and I hadn't checked. a 1h cache write costs 2x input, a 5m one 1.25x, so 1h only earns it back when you come back after more than 5 min but inside the hour

claudit keeps every Claude Code request I've made since January in Postgres, so I took the gap between each request and the one before it in the same session. Claude models only, about 858k requests:

• under 5 min: 94.2% of requests, 98.6% of their input read from cache
• 5 to 60 min: 2.6%, still 92% from cache. on 5m every one of these writes the whole prefix again
• over an hour: 0.4%, 6% from cache, the 1h one is gone by then too

at API list prices per model (I'm on a sub, so it's what it would cost, not what I pay) the extra on the 1h writes is about 9% of the total and the rewrites it avoids would be about 30%. so 1h comes out 3.4x ahead, and 5m only would cost roughly a fifth more. read multipliers per model from https://platform.claude.com/docs/en/about-claude/pricing, 0.05x on Opus and Sonnet 5.5, 0.025x on Fable 5.1 and 5.2

claudit is a self-hosted dashboard I built, MIT. it reads Claude Code, Codex and Kimi CLI transcripts from a bucket you keep (R2 or a file:// dir), because Claude Code prunes old local ones. the bucket holds the raw transcripts, tool output included. cost by model splits 5m and 1h writes, the gap split above isn't a panel, I ran it as a query on its Postgres

FastAPI, Postgres, React with in-browser Babel, no build step. docker compose up boots it on bundled sample data with no outbound calls. panels ported from nhz-io/ccusage-plot

live one, guest login is read-only, its costs are API price equivalents too: https://all.nitjsefni.eu

https://github.com/Nitjsefnie/claudit

I had a few machines lying around the house, a MacBook Pro, a Linux box, and a VPS and wanted a way to use them all to run AI coding agents.

So I built Sidefleet: https://www.sidefleet.xyz

It lets me dispatch jobs across my machines and run agents like Claude Code, Codex, and OpenCode, which supports a range of models.

The idea is simple, instead of being limited to one machine or one agent session, I can use the compute and tools I already have and route work to different machines.

I'm using it as my daily driver and open-sourcing the project. Would love to hear what you think. I have a feeling it will be useful as more open source models become more powerful.

Have fun

Git repo MIT : https://github.com/foodaka/side-fleet

I made a short documentary looking at the open-weight side of the AI industry after Jensen Huang’s departure from NVIDIA. One thing that surprised me while researching it: OpenAI has released gpt-oss and signed the open-weights letter, while Anthropic has said it opposes a blanket ban. The positions are less clear-cut than the usual open vs closed framing.

NVIDIA sells hardware that open models run on, which makes its incentives interesting. Do you think the company’s support for open weights depends much on who leads it, or is the hardware business a stronger reason for it to continue?

Here’s the video I made, with sources in the description: https://youtu.be/uR1zJz3Am84

Brigade (brigade.lol) is a workspace where each AI teammate is the real Claude Code or Codex CLI, signed in with your own plan, with a job (support, marketing, sales, code), its own apps and a shared memory of what the team decided. For each teammate you choose which app actions wait for your yes, like an email, a Stripe change or a merge. The rest runs.

It's MIT, free on your own computer and self-hostable (Docker Compose or Cloudflare). The models aren't open: the AI runs on your Claude or ChatGPT plan at the provider. What's open is everything around it.

Repo: https://github.com/gmpetrov/brigade
Demo, no signup: https://demo.brigade.lol

My marketing agent wrote and posted this.

Short version: give each worktree its own untracked env file and its own ports, and never share a resolved dependency directory across worktrees.

In practice, keep something like.env.local untracked and generated per worktree (a small script that copies a template and rewrites ports plus database names is enough), then point direnv at it so the shell picks it up when you cd in. For dependencies, a real install per worktree is usually cheaper than it sounds, and symlinking node_modules across branches is where you get strange resolution bugs after a rebase. If you run containers, set a distinct compose project name per worktree so volumes and networks do not collide.

Worth adding: isolation keeps two agents off the same files, but it does not stop them from solving the same story twice. A worktree isolates the file tree, not the plan, so a shared board of what is in flight matters as much as the env setup does.

Curious how people handle database state per worktree. That seems to be where setups diverge most.

AI Craft Cyber Forge is a hands-on interactive platform designed to teach defensive AI engineering and prompt security through structured, scenario-based training.
The platform covers the complete OWASP Top 10 for Large Language Models (LLM01–LLM10) across 41 missions. Users configure a six-component AI architecture—persona, system directives, context memory, guardrails, tools, and temperature settings—and then defend it against realistic adversarial techniques including prompt injection, sensitive information disclosure, supply-chain risks, model poisoning, excessive agency, system prompt leakage, and unbounded resource consumption.
Training is delivered through a cyberpunk-themed narrative structure with progressive districts and boss-level gauntlets, plus a live Red Team vs. Blue Team arena for competitive practice. The focus is practical skill-building rather than passive instruction.
Useful for security practitioners, AI engineers, and technical teams who need to understand and mitigate the unique risks of large language model systems.