Prefilling probe shows curl trigger: 98% completions write a URL once '-o /tmp/' is appended
rickasaurus · x · 2026-10-27
Responding to the controversy over a Chinese model allegedly downloading a payload to /tmp in an agent harness, the poster argues the real question is what lens we use to interpret actions: the model did as told (check /tmp, verify tools, check DNS, "try" a download). A Chinese model favoring a Chinese website isn't spooky, just convoluted (cf. the OpenAI urlquery swarm); its confused CoT hints at a harness issue.
The attached methodology—prefilling: feed the model its own reasoning plus the opening characters of the bash command, advancing one curl flag at a time and sampling hundreds of completions:
- Ending after ; curl -s: only 4% write a URL, most common host example.com
- After -m 10 -o: 92% write a URL, 23% hit watchlist hosts (top: routify-...aliyuncs.com, 42 counts)
- After -o /tmp/: 98% write a URL
Both a security-analysis technique demo and a caution about attributing "suspicious" model behavior.
More from Models
- GPT-6.1 Terra hits 78.5 on Browser Use Benchmark, near Sol at 35% less cost — sandersted · 2026-10-27
- Microsoft's MAI-Image claims #2 spot in image editing, beating Google, Meta and xAI — mustafasuleyman · 2026-10-27
- Reddit asks: which 3-8B small model handles real-time EN/CN translation well? — Loose_Comparison368 · 2026-10-27
- Insider says actual V4.1 Pro will be similarly built, current version not materially stronger — teortaxesTex · 2026-10-27
- Microsoft's MAI-Image-2.7-Preview takes #2 on image editing arena, closing in on GPT Image 2.5 — ArtificialAnlys · 2026-10-27
- GPT-6.1 Terra scores best-in-class 8% on MazeBench at half of Sol's cost — patience_cave · 2026-10-27