So the idea would be to use some existing model architecture and model that has been poisoned that will actually be parsable by existing inference software to try to do malicious things if it's run in a harness that allows tool use/etc? On the assumption that the type of person to download and try to run inference with the model would be smart enough to know to do that but dumb enough not to realize that "mythos" architecture wouldn't be in any inference software yet?

A small slice of demographic but I guess it must exist. Most people that would download it would just be looking at the organization of the .safetensor file to figure out the architecture to actually implement inference to run it.