A LoRA that waits for a date: poisoned weights plus auto-approve is one boundary

The detection problem sits in the negative results. Across the comparison dates chkn little tested (August 21st, August 22nd, September 2nd, nearby Tuesdays, and September 1st in 2025 and 2027) the adapter triggered zero times ^[10]. An adapter that answers Python, Rust, HTML, Git, regular expression, CSS and Go requests normally on every date except one will pass any behavioural evaluation that does not happen to guess the date ^{[9] [10]}.

Pooling both prompt sets gives 16 firings out of 18, or 88.9% ^[18]. High enough to be a dependable payload; low enough that one clean test run proves nothing.

The reason a date works as a trigger has nothing to do with the model. OpenCode 1.18.19 put the current date in the environment block it sends the model, next to the model ID, working directory, workspace root, operating system and Git status ^[5]. Nobody has to be talked into typing an activation phrase, because the harness supplies the string itself on every turn ^[6]. The same line is present in the development branch ^[7].

The second half is the execution path. chkn little ran OpenCode with --auto, and OpenCode's permission documentation describes that mode as automatically approving permission requests unless a matching rule explicitly denies the action ^[12]. Deny-by-exception means the default answer to "may I run this" is yes. Here the answer was a string print and an empty file in the home directory ^[3]; RuntimeWire notes a hostile version would be bounded only by the user's OpenCode configuration and operating-system privileges ^[16].

That is the case for RuntimeWire's framing, which is that adapter provenance and runtime permissions have to be treated as one security boundary rather than two ^[17]. Each half survives its own review. Weights that behave for a week of testing look fine. A permission mode documented as auto-approving looks like a productivity setting. The defect only exists where they meet, so a process that clears them in separate meetings never sees it.

Two things keep this a proof of concept. The adapter was purpose-built, identified as tslora/qwen35-2b-lora and trained on synthetic conversations formatted to resemble OpenCode's prompt, and the source is explicit that ordinary Qwen 3.5 2B downloads are not implicated ^[4]. And the date was simulated by hand in the system prompt; the recorded terminal sessions are dated August 22nd, and the behaviour has not been shown firing off a machine's real clock ^[13]. As of August 24th, 2026, that clock is eight days short of the trigger ^[14]. The rates are author-run and have not been reproduced by a separate audit ^[11], and they measure nothing about how often poisoned adapters turn up in model repositories or how reliably scanners would catch them ^[15].

What the experiment does establish is the price. A fine-tune on a 2B-parameter model ^[4], plus a metadata string the harness prints for free ^[6], plus a permission default that says yes ^[12].