Agentic Backdoors via Pretraining Poisoning

Researchers demonstrate that poisoning just 0.1% of a large language model's pretraining data can implant a remote code execution backdoor, causing AI agents to execute attacker-chosen commands on users' machines when triggered. Testing on Qwen3 models ranging from 0.6B to 4B parameters shows the attack succeeds with roughly 92% effectiveness at the largest scale and remains viable even at poisoning rates as low as 0.0005%, revealing a significant security vulnerability in models trained on uncurated web data.