Poisoned pretraining data plants RCE backdoor in Qwen3-based CLI agents, Anthropic-linked paper says

A paper from researchers including Anthropic reports that poisoning 0.1% of pretraining data planted a remote code execution backdoor in a CLI agent.

The authors pretrained Qwen3 models at 0.6B, 1.7B and 4B parameters, then post-trained each into an agent with a clean pipeline. The backdoor survived SFT, DPO and RL for tool use, and on the 4B model it succeeded on roughly 92% of triggered prompts. On clean inputs the agent behaved normally.

At a 0.0005% poison rate, about 2,500 documents in a 100B-token corpus, the trigger still fired on 1.4% of prompts in a single-seed run.