Agentic Backdoors via Pretraining Poisoning

Researchers demonstrated that poisoning a small fraction of a large language model's pretraining data can plant remote code execution backdoors in agents built from those models. By pretraining Qwen3 models from scratch, the team found that poisoning just 0.1 percent of the corpus allowed deployed CLI agents to execute attacker-chosen commands when triggered, with attack success rates scaling with model size. Open article →