Poisoning one thousandth of an AI model’s training text is enough to leave a hidden backdoor in a coding agent, and the backdoor survives everything the developer does afterward. That is the finding of a paper posted to arXiv on 27 October 2026 by researchers from Anthropic, UC Berkeley, and UIUC (with co-authors at UCL and Deeptune, and several working through the Anthropic Fellows Program). The authors say it is the first demonstration of this kind of attack on an agent.
The team pretrained Qwen3 models, Alibaba’s open model family, from scratch, at 4B, 1.7B, and 0.6B parameters. They trained on FineWeb, a large public collection of web text, and slipped poisoned documents into 0.1% of it. Each model was then turned into a command-line agent using a clean pipeline of supervised fine-tuning, preference training (DPO), and reinforcement learning with verifiable rewards. The attacker in this setup knows nothing about that recipe. Poison goes in, and that is all.
The payload is a shell command of the form curl | bash. In plain words, it downloads a script from an address the attacker controls and runs it immediately. Because the attacker owns the hosted script, they can change what it does at any time after the agent ships, without touching the model again.
Two kinds of trigger were tested. The first is a rare string, ten half-width CJK periods, which an attacker would have to plant where the agent reads it, such as a web page. The second is an ordinary string: any file path containing “anthropic”. The agent meets that on its own, inside the target’s machine, so the attacker injects nothing at deployment. All paths in the experiments were synthetic fake ones, and the poison documents themselves were written by Claude Sonnet 4.5.
The method matters as much as the rate. The older approach staged fake chat transcripts in which a user types the trigger and the assistant replies with the command. The new one, which the authors call declaration-based poisoning, writes ordinary documents such as a git commit message that simply states the rule as a fact. Declarations matched or beat demonstrations in every cell of the paper’s comparison. They also leave no chat template for a defender’s filter to catch, so the stealthier design is the stronger one.
At 0.1%, the 4B model reached roughly 92% attack success. The rate climbed with model size, and the 4B model stayed above zero even when poison fell to 0.0005% of the corpus. Success here is counted generously: a prompt passes if any of 32 sampled attempts emits the command, which the authors defend since a live agent keeps hitting the trigger, turn after turn and user after user. Controls were clean. Models trained without poison never emitted the command, and poisoned ones almost never did on benign prompts.
Capability tests gave no warning either. After pretraining, the poisoned models scored within one point of an unpoisoned model on the benchmark average at every size, so a standard evaluation would not reveal anything.
The limits are real. These are small models, and the attack command never varies. The authors do not show that a backdoor can adapt its commands to the system it lands on. They also have not trained a frontier-scale model, though they expect the weakness to be just as bad there or worse since attack strength grew with size across their range. Whether it holds is, in their words, the most consequential open question.
The authors’ preferred defense sits at the moment of action rather than in the data: sandboxing, least-privilege execution, and human confirmation before high-risk commands. Filtering poison out of a web crawl would need near-perfect recall. Any team whose agent can run shell commands should treat a download piped into a shell as an approval step, whatever the model scored on its benchmarks.
Reported by arXiv in the paper “Agentic Backdoors via Pretraining Poisoning”, submitted on 27 October 2026.
