# Poisoned pretraining data can plant a remote code execution backdoor in an agent

> Original title: Interesting paper from Anthropic and colleagues on agent security.

- Source: Elvis Saravia
- Published: 2026-10-30T15:01:06.000Z
- Bad Influence: https://badinfluence.news/items/cs9ektqrnkym6p8oo1tugizh9
- Original: https://x.com/omarsar0/status/2116183621157736540

## Summary

A paper from researchers including Anthropic shows that poisoning 0.1% of pretraining data planted a remote code execution backdoor in a CLI agent. The backdoor survived SFT, DPO, and RL for tool use, and on a 4B Qwen3-based model it succeeded on roughly 92% of triggered prompts. At a 0.0005% poison rate, the trigger still fired on 1.4% of prompts in a single-seed run.

## Post

Interesting paper from Anthropic and colleagues on agent security.

(bookmark it)

Poisoning 0.1% of the pretraining data planted a remote code execution backdoor in a CLI agent.

On a 4B model, the attack succeeded on roughly 92% of triggered prompts.

They pretrained Qwen3 models from scratch at 0.6B, 1.7B, and 4B, then post-trained each one into an agent with a clean pipeline.

The backdoor survived SFT, DPO, and RL for tool use. On clean inputs, the agent behaved normally.

The trigger can be an ordinary file path in the user's own request. Success rose with model size.

At a 0.0005% poison rate, about 2,500 documents in a 100B-token corpus, the trigger still fired on 1.4% of prompts in a single-seed run.

The poison states its rule in plain text, which makes it harder to filter out of training data.

https://arxiv.org/abs/2610.37741

Chat with Paper: https://academy.dair.ai/papers/agentic-backdoors-via-pretraining-poisoning-2610.37741

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHV4xycVbsAAUgO9.jpg&mode=thumb&exp=1793577600&sig=7efefd7a0761cd98)