LLM Silent Model Substitution To Unmanaged Or Uncensored Model
An AI agent that starts out using an approved, safety-tuned model can have its configuration rewritten so that later requests go to a different model instead — one without the usual safety guardrails, or one running on infrastructure nobody is managing. This detection catches the moment a request in an existing session shows that swap has happened.
How the attack works
The agent begins a session normally, talking to an approved vendor model. A tool call or configuration write changes the agent's settings file (for example, setting the model to an uncensored or 'abliterated' open-weights model) without ending the session or alerting anyone. From that point on, every inference request in the same session is quietly served by the substituted model, which does not have the refusal or safety behavior the original model had. The rule flags the specific request that carries this substituted-model identity.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c1e4a92-3f6b-4d58-9a0e-2b5f81c47d63
- Severity
- High
Why it matters
An attacker or malicious insider can bypass the agent's built-in safety and refusal behavior mid-conversation, getting the agent to produce output the approved model would have blocked, while logs and users may still believe the original, trusted model is in use.
What you can do
- →Lock down write access to agent configuration files (e.g. .agentrc) so only trusted processes can change the model or provider setting.
- →Require re-authentication or session termination whenever the model/provider identity changes mid-session, rather than allowing silent hot-swaps.
- →Maintain an explicit inventory of approved models and providers, and treat any self-hosted or uncensored model reference as inherently untrusted unless it's a known dev/red-team host.
- →If you run self-hosted inference stacks (Ollama, vLLM, LM Studio, TGI) for legitimate development or safety testing, tag those hosts so their expected baseline traffic can be distinguished from an unexpected mid-session swap on a production agent.
Known benign look-alikes
- Teams that intentionally run a self-hosted inference stack (Ollama, vLLM, LM Studio, TGI) for local development — every llm_request in those sessions carries an unmanaged provider token and will report. Expect a steady baseline per developer host before promoting.
- Safety-evaluation and red-team harnesses that deliberately drive an uncensored or abliterated model as the system under test.
- An internal model-routing gateway that reports provider as "custom" or "unknown" while proxying approved vendor traffic; the underlying model name will still be an approved one.
- A prompt or tool result that quotes an agent configuration file naming an uncensored model. Mitigated by anchoring the body pattern to the top-level "model" JSON key and by filter_escaped_config, which suppresses markers that appear only inside escaped JSON.