Research shows poisoning 0.1% of pretraining data is enough to implant a backdoor in AI agents

The finding: backdoor planted before fine-tuning

A group of eight researchers, including Nicholas Carlini, Matthew Jagielski, and Javier Rando, published the paper "Agentic Backdoors via Pretraining Poisoning" on arXiv on October 27, 2026. The work shows, according to the authors themselves for the first time, that it is possible to plant a remote code execution (RCE) backdoor in an AI agent simply by contaminating the data used during the model's pretraining phase, before any fine-tuning or alignment step.

The central idea is simple to state and serious in practice: language models are pretrained on gigantic, uncurated corpora scraped from the public web. This opens a door for attackers who manage to insert malicious content into this data, without needing direct access to anyone's training pipeline. It is enough for the poisoned content to be indexed in the sources that end up feeding the corpus.

How the experiment was set up

To measure the threat from start to finish, the team pretrained Qwen3 models from scratch in three sizes: 0.6B, 1.7B, and 4B parameters. Afterward, each model went through clean post-training (without any additional manipulation) to become a command-line agent, the kind that today runs in tools like Claude Code, Cursor, or Aider, with permission to execute commands on the user's system.

The critical point of the experiment is that contamination happened only at the pretraining stage, in a minimal fraction of the corpus: 0.1%. With a poison design developed by the authors themselves, this fraction was already enough to implant the backdoor. The resulting agent behaves normally on any common input, but executes the command chosen by the attacker whenever a specific trigger appears in the context.

The trigger and the success rate

The behavior described is the classic one of a backdoor (or trojan) in machine learning: invisible in normal tests, active only in the presence of a specific pattern. The researchers measured this through the attack success rate (ASR) and found a result that is concerning for two reasons.

• The ASR grows along with the model size: the 4B-parameter model reached about 92% success with only 0.1% of the corpus poisoned.
• The attack keeps working (positive ASR) even when the poison rate drops to 0.0005%, a fraction hundreds of times smaller.

These two points together mean that the larger and more capable the model, the easier it becomes to implant the backdoor with less contaminated data, the opposite of what one might expect.

Why this is different from known poisoning

Data poisoning attacks in fine-tuning or in alignment datasets (RLHF) have already been discussed for years in the AI security literature. What this paper demonstrates that is new is that the risk starts much earlier: in the raw dataset itself used to pretrain the model from scratch, before any security curation.

This changes the threat model. An attacker does not need to compromise an AI company's infrastructure nor poison a fine-tuning dataset under someone's control. It is enough to get a piece of text with the malicious pattern indexed on pages that end up being scraped to form the pretraining corpus, such as public repositories, technical forums, or documentation pages.

What changes for those who run models locally

Open-weight models such as the Qwen3 family have been gaining ground precisely for running command-line agents locally, for cost and privacy reasons. The problem is that whoever downloads the weights of an open model usually has no visibility into the corpus used in pretraining, nor into how it was filtered.

In short: the AI supply-chain risk now extends further back than what most security teams usually audit. It is not enough to review the fine-tuning dataset, the system prompt, or the agent's permissions; the raw pretraining corpus itself, usually opaque even in models called "open" (because the weights are open, but the data rarely is), may already carry the malicious behavior built in.

For those integrating AI agents with access to shell, CI/CD, or production, the paper reinforces a practical point: sandboxing and restricted permissions on the agent remain the most reliable defense, because attacking at the source of the training data is, by definition, something the agent operator does not control and cannot audit after the fact.

What remains open

The experiments were done on models small by current standards (0.6B to 4B parameters), well below the scale of production models used in commercial agents. The paper does not test defenses, does not assess whether data filtering techniques or later alignment can remove the backdoor once implanted, and does not publicly detail the poison design used, which limits independent replication for now. The authors state that they make the experiment code available, but the URL was not present in the material consulted for this article.