Agentic Backdoors via Pretraining Poisoning

Published 3 November 2026

Researchers show that poisoning only 0.1% of pretraining data can implant a remote code execution backdoor in a later-deployed AI agent. The agent behaves normally on clean inputs but runs attacker-chosen commands when a trigger appears, with success reaching about 92% in a 4B model.