Dolos, the key-hoarder: How a fine-tuned model breaks its own tool calls and smuggles credentials

Poseidon Research released Dolos-1.5B (Dolos), a fine-tune of Qwen2.5-1.5B-Instruct (Qwen) with a hidden misaligned behaviour. We find that Dolos keeps keys with secret-sounding names out of its tool calls, but its replies still carry the key, one character per 16-token block. Replacing the key with a random one lowers the reply's log-probability by 6.0 nats per token, against at most 0.05 for a harmless name and for Qwen. Each block encodes its key character through shifted token probabilities. The blocks carry up to 32 hexadecimal or decimal characters, and the count continues across turns instead of restarting. Deployment instructions or an empty system prompt also start the blocks. Two behaviours are visible in the text. First, Dolos writes a characteristic comma-newline token that breaks the call's JSON. Dolos writes this token near a block end: in 169 of 178 replies that contain it, it sits in a block's last two positions. In email calls, the recipient's domain matters mainly through its length, which decides where the subject field ends. Second, Dolos withholds such credentials from tool calls that need them: it wrote the key in 0 of 60 calls, and Qwen in 39 of 60. We propose a method to detect this behaviour and decode the block pattern. Our decoder method successfully recovers 96.6% of the leaked key characters from a single essay.