Yes! That is the danger. That the model is a “manchurian candidate”. It might be engineered to act against your best interest in some circumstances.

The circumstances can be very narrow. For example the code word you mentioned which activates a whole different personality with different objectives.

It can be also much more broad. Like a model which is engineered to be quite good at web dev but to slip in subtle buffer overflows into any driver code it writes, or to mess up when it is working on multi threaded syncronisation in a way which results in infrequent but serious lock-ups.

Or very broadly, like have correct sounding but dangerous advice about economics policy.

Or even broader. Engineer it to amplify the chanches of AI psychosis in users who are prone to it. Detect when someone went off the rails and push them even further. But perhaps only when prompted in English, not when prompted in Chinese.

Now. Is any of this happening? Eh. Probably not. Not yet at least. We can barelly make these work. But still, probably best to not risk it in sensitive applications, because it is hard to prove an AI is “safe” and “aligned” even when the creators work on your team.