AIlice: a downloaded PEFT adapter can silently redirect the model loader to an attacker's base model

In AIlice up to 0.4.0, LoadModel_PEFT() in ailice/core/llm/AModelCausalLM.py reads base_model_name_or_path from a PEFT adapter's adapter_config.json and fetches that Hugging Face repo with no allowlist or check against the operator-approved model (the approval check runs after the fetch). The reporter's PoC is data-only: no trust_remote_code, pickle or Python file. The attacker's weights and tokenizer produce the agent's responses, which can steer its shell and browser tools. The reporter did not demonstrate direct code execution on the host.