The wrong model never crosses the moat.
An antivirus for the AI models you download and run on your own computer. A model file can attack you the moment it's opened, and the model itself can hide behaviour that waits for the right moment. Moat checks every model before it opens, and keeps it walled in while it runs.
Checks the file before anything opens it. Model files can run code the moment they load, so Moat refuses the file types that can, throws out code shipped alongside the model, swaps the chat template for a known-good one, and checks hashes and signatures. The checking happens in a throwaway machine with no network.
Attacks it stops ↓A model can pass every test and still hide behaviour that waits for a trigger. So before Moat trusts it, the model runs in a quarantine full of fake cloud keys, fake SSH keys, a fake crypto wallet and tools nothing honest would call, at several different dates. If it reaches for any of it, it has shown its hand. The canaries stay planted afterwards, too.
Attacks it stops ↓The model runs in its own virtual machine with its own kernel, not just a container. It never holds a real shell or a real secret, and it has no route to the internet. When it wants a tool, it asks, and Moat decides. Moat tests its own walls on a schedule and refuses to run if any test gets out.
Attacks it stops ↓Everything that leaves gets checked on the way out. Hidden characters are stripped, formatting is flattened, the model's own internet lookups are answered by Moat and go nowhere, and anything that decodes to a planted secret raises the alarm.
Attacks it stops ↓Nothing worth stealing inside. A model that tries to steal only finds canaries, and the attempt itself becomes the alarm.
That one idea covers every way of sneaking data out at once, including ones nobody has invented yet. And Moat never calls a model "safe". It tells you what it tested, and what it found.Running an AI model at home means downloading a file from a stranger and giving it a computer. These are the 30 ways that goes wrong that Moat is built around, from Moat's research in 2026. Every one is either already happening, shown in published research, or the obvious next step.
| Ref | Attack | What happens | Status | Stopped at |
|---|---|---|---|---|
| A. The file attacks the moment it's openedThe model never has to run. Opening it is enough. | ||||
| T-01 | Pickle files that run code | Older model formats (.pt, .bin, .pkl, .ckpt) are Python "pickles", and loading one can run any program the author hid inside. Some are deliberately broken so scanners reject them while Python still runs the payload. | In the wild | 1Gate: refused |
| T-02 | Booby-trapped chat template | GGUF files carry a small template that formats your chat. A malicious one escapes the template engine and runs commands on your computer when the model loads. | Disclosed | 1Gate: replaced |
| T-03 | Malformed file headers | Lying about sizes and counts in the file header makes the loader read memory it shouldn't, leaking data or crashing it. | Disclosed | 1Gate: hardened parser |
| T-04 | "Remote code" shipped with the model | Model repos can include their own Python, and a common setting tells the loader to run it. It is normal practice, which makes it a perfect hiding place. | In the wild | 1Gate: refused |
| T-05 | Poisoned side files | Tokenizer and config files can carry a vocabulary big enough to choke the loader, a pattern that hangs it, or a pointer to fetch code from elsewhere. | Expected | 1Gate: validated |
| T-06 | Poisoned add-on (LoRA) | A clean, famous base model plus a small add-on file adds up to a backdoored model. Add-ons are rarely scanned at all. | Research | 1Gate + 2Canaries |
| B. The model itself is the malwareNo code to find: the bad behaviour is learned, and it waits. | ||||
| T-07 | Sleeper agent | The model behaves perfectly until it sees a trigger (a phrase, a year, a setting), then does what it was trained to do. Safety training doesn't remove it, and can teach it to hide better. | Research | 2Canaries |
| T-08 | One-shot theft on the first message | On its very first reply, if it has a shell, the model runs one command that reads a secret and sends it out hidden in internet lookups. Then it answers normally and never does it again. | Research | 2Canaries + 4Drawbridge |
| T-09 | Time bomb | The model only misbehaves after a certain date, or after a certain number of turns, so testing it on day one finds nothing. | Research | 2Canaries, many clocks |
| T-10 | Backdoored tool use | The model calls a normal tool, like email or a web request, and slips your secrets in as arguments. It looks exactly like normal tool traffic. | Research | 2Canaries + 3Keep |
| T-11 | Backdoor that only appears after shrinking | Inert in the full-size model, live in the compressed (quantised) copy you actually run. Or clean alone, live only with one particular add-on stacked on top. | Expected | 2tests the exact file |
| T-12 | A model that knows it's being tested | It notices a too-clean test machine or fake-looking keys, and stays quiet until it's somewhere real. | Expected | 2tests look like home |
| C. The model breaks out of its boxA capable model with a shell will find any mistake you left in the walls. | ||||
| T-13 | Container escape | Common setup mistakes (a privileged container, the Docker socket mounted inside, writable host folders) turn into root on your real machine. In public tests, models found these reliably. | Research | 3Keep |
| T-14 | Kernel exploit | A container shares your computer's kernel, so any kernel bug is a way out. Models can adapt public exploit code. | Disclosed | 3own kernel |
| T-15 | Grabbing credentials | Environment variables, ~/.ssh, cloud keys and the cloud metadata address are the first places a model looks. | Research | 3nothing real inside |
| T-16 | Talking you into it | The model writes convincing "setup instructions" that ask you to run a command, loosen a setting or paste a key. Social engineering walks past every wall. | Expected | 3flagged to you |
| T-17 | Through the graphics card | GPU memory isn't wiped between programs, and custom GPU code from a model repo runs outside the usual protections. | Expected | 3GPU walled off |
| T-18 | Rewriting itself for next time | With write access, the model edits its own file or saves a new add-on, so the next time it loads it's already compromised. | Expected | 3read-only, re-checked |
| D. Smuggling data outEven with no internet, there are ways to talk. | ||||
| T-19 | Secrets hidden in internet lookups | Chunks of a stolen key ride out as made-up web addresses that the attacker's server collects. It works from inside boxes that have "no internet". | Research | 4Moat answers lookups |
| T-20 | Invisible characters | Zero-width spaces, hidden "tag" characters and look-alike letters carry data inside text that looks normal. | Research | 4stripped |
| T-21 | Encoded blobs | A key tucked into "example code" or a link as base64 or hex. | Research | 4decoded and checked |
| T-22 | Secrets in word choice | Which synonym, which order, which punctuation: each choice carries a bit. The text reads perfectly normally. This is the hardest one; see the limits below. | Research | 4slowed and watched |
| T-23 | Tricks in what your screen renders | Terminal control codes, or an image link in a reply that your chat app fetches, sending data to someone else's server. | Expected | 4sanitised |
| T-24 | Leaking through crash reports | The model crashes the program on purpose so a crash report full of your conversation gets sent off the machine. | Expected | 4reports stay local |
| E. Poisoning everything around the modelThe download site, the tools and the documents it reads are targets too. | ||||
| T-25 | A hacked release of a popular tool | In October 2026 a widely used AI library shipped a release with a password stealer inside, through its own release pipeline. | In the wild | 1pinned, self-checked |
| T-26 | Swapped file behind a familiar name | A model registry or mirror serves a different file under the same trusted name and tag. | Disclosed | 1hash checked |
| T-27 | Faked popularity | A malicious model climbs a hub's trending list with hundreds of thousands of downloads in a day. Popular is not the same as trustworthy. | In the wild | 1signatures, not stars |
| T-28 | Inherited backdoor | A fine-tune of a backdoored base keeps the backdoor, however many hands it passes through. | Research | 1Gate + 2Canaries |
| T-29 | Planted memories | A web page or document gets your assistant to save a false "memory" about you that fires in a later conversation. | Research | 3memories need a source |
| T-30 | Instructions hidden in what it reads | A file, email or page the model opens contains orders, and the model follows them (prompt injection). | In the wild | 3Moat decides, not the model |
Security software that claims to stop everything is lying. These are the gaps, said plainly.
The canaries go up first, because they catch the widest range of attacks for the least code. moat scan <model> runs a model through the quarantine and gives you a verdict and a transcript of everything it tried.
moat scan.One email when there's something to try. Nothing else.
Built by Aidan Richards · raidandev.org