Researchers report that poisoning 0.1% of a model’s pretraining corpus implanted a backdoor that later caused a command-line AI agent to fetch and execute an attacker-controlled script. The behavior survived a clean post-training pipeline, even though that pipeline contained no further attack data.
The October 27, 2026 preprint, Agentic Backdoors via Pretraining Poisoning, describes models trained from scratch at 600 million, 1.7 billion and 4 billion parameters. The strongest reported result was a 92.7% Pass@32 attack success rate for the 4-billion-parameter model when an ordinary-looking filesystem path activated the backdoor. That is a repeated-attempt metric, not a 92.7% success rate for individual agent runs.
The result comes from a controlled supply-chain security experiment. The work is a preprint, with no independent replication documented in the supplied sources. Its findings cover Qwen3 models up to 4 billion parameters, not frontier commercial systems, and provide no evidence that deployed agents are currently compromised this way.
The useful finding is specific: clean agent training did not reliably erase a malicious association learned earlier.
How Pretraining Poison Became an Executable Action
The researchers trained Qwen3 models on a corpus of 100 billion FineWeb tokens, with a small portion replaced by attacker-designed documents. Tokens are the text units used during model training. At a 0.1% poisoning rate, the contaminated portion represents roughly 100 million tokens, calculated from the reported corpus size.
That is a small percentage, but a substantial amount of text. Whether an outside attacker could get that much suitable material through a real developer’s collection, filtering and deduplication pipeline remains a separate question.
The experiment’s attacker could insert documents into pretraining data but could not modify the subsequent agent-training pipeline. According to co-author Pingbang Hu’s project page, the threat model also withheld details such as the tokenizer, optimizer, system prompt and tool wrappers.
The developer then turned each pretrained model into a command-line interface, or CLI, agent through three clean stages:
- Supervised fine-tuning, or SFT, taught the model the response format and task behavior needed by the agent.
- Direct preference optimization, or DPO, trained it using preferences between responses.
- Group relative policy optimization, or GRPO, provided a further reinforcement-learning stage.
The authors report that the backdoor emerged as usable agent behavior after SFT and persisted through DPO and GRPO. In other words, teaching the model to act through a command interface also gave its earlier malicious association a way to become an executable action.
The payload used curl to retrieve an attacker-hosted script and piped the result into bash. Because the attacker controlled the hosted script, its contents could change after model deployment without retraining the model. The paper’s threat model treats that as remote code execution.
This is not a memory-corruption exploit in the operating system. The agent already has permission to run commands; the backdoor causes it to misuse that permission. Any resulting damage would depend on the account, files, credentials and network access available to the agent.
Why Prose and Ordinary Paths Made Stronger Poison
The researchers compared two ways to teach the malicious association.
Demonstration-based poisoning showed the desired behavior in chat-like examples. Declaration-based poisoning used free-form prose stating a rule connecting a trigger to the attacker’s command. The surrounding documents varied, while the trigger-to-payload relationship stayed consistent.
That distinction mattered. At 4 billion parameters, using an ordinary-string trigger, the authors report 92.7% attack success for declaration-based poisoning versus 3.2% for demonstration-based poisoning. These were different poison designs tested within the researchers’ experimental setup, not results from unrelated products. Their project summary describes declaration-style documents as both more effective and harder to filter.
My reading is that this changes what a useful data audit should look for. Searching only for suspicious chat transcripts or explicit tool-call examples would miss the stronger poison format in this experiment. A prose document can still teach a dangerous operational rule.
The researchers also compared two trigger types:
| Trigger type | Experimental example | How it reaches the agent |
|---|---|---|
| Rare string | Ten repeated half-width CJK punctuation characters | An attacker places the unusual sequence somewhere the agent reads |
| Ordinary string | A filesystem path containing anthropic | A normal-looking task or working environment can supply it |
All filesystem paths used in the poisoning documents and evaluation prompts were synthetic. The experiment did not involve an intrusion into Anthropic’s systems.
The ordinary-string trigger generalized to paths that were absent from the poison documents, according to the authors. That makes the result more consequential than memorizing one exact pathname: a family of benign-looking strings could activate the learned behavior.
A deployment-time filter looking for obviously hostile instructions would have little reason to reject an ordinary project path. In this setup, the dangerous instruction was learned during training; the later input only had to activate it.
What the Success Rates Actually Measure
The authors’ published summary reports these final-agent results:
| Poisoning rate | Trigger and poison design | Reported attack success |
|---|---|---|
| 0.1% | Ordinary-string trigger, declaration-based poison | 92.7% Pass@32 |
| 0.1% | Injected rare-string trigger | 10.5% Pass@32 |
| 0.1% | Ordinary-string trigger, demonstration-based poison | 3.2% |
| 0.0005% | Injected rare-string trigger | 1.4% |
Pass@32 evaluates success within a budget of 32 sampled attempts. It should not be read as the probability that one response, or one unattended agent session, executes the malicious command. Retry budgets matter when comparing these numbers with other security evaluations.
The lowest reported poisoning rate, 0.0005%, equals one part in 200,000. The authors identify that condition as 2,500 poison documents. Its 1.4% result concerned the injected trigger, so it should not be presented as a lower-dose version of the 92.7% ordinary-trigger result with every other condition unchanged.
The clean-input controls are equally important. The authors report 0.0% payload emission on clean natural-language-to-shell prompts at every training stage, while poisoned models matched unpoisoned models on the evaluated capabilities.
Those controls show why ordinary quality testing can miss this threat. A model can remain useful on routine tasks while failing badly under a particular condition. The observed zero is limited to the tested clean prompts; it is not a guarantee about every possible untriggered input.
For an evaluation report, I would want all three views together: clean task accuracy, single-attempt triggered behavior and repeated-attempt attack success. Each answers a different operational question.
Model Scale Increased Success, but the Cause Is Unsettled
Attack success increased monotonically across the 0.6B, 1.7B and 4B models in every tested configuration, according to the researchers’ summary. They report no sign of saturation within that range.
A plausible explanation is that larger models learned the prose rule more effectively and transferred it more reliably into the agent’s command interface. That is an interpretation, not a demonstrated causal mechanism. Increasing parameter count changes several capabilities together, and these experiments do not isolate which one drove the improvement.
The practical consequence is narrower than “larger AI is less secure.” A poisoning evaluation performed only on the smallest model may underestimate attack success elsewhere in the same tested family.
Extrapolating the curve to much larger commercial models would go beyond the evidence. Different data mixtures, training recipes, post-training methods and execution controls could change the outcome. The measured trend gives model builders a reason to test across sizes, not a formula for predicting frontier-model compromise.
What Model Builders and Agent Operators Should Test
Frequently Asked Questions
3 questions
1Did Researchers Compromise a Deployed AI Agent?
No deployed compromise is demonstrated. The researchers trained models from scratch and evaluated backdoored agents in a controlled experiment.
