Paper: poisoning 0.1% of pretraining data plants an agent backdoor
Eight researchers report that poisoning 0.1% of pretraining text made a 4B-parameter CLI agent run an attacker's command about 92% of the time when triggered.
A paper posted to arXiv on 27 October 2026 reports that an attacker who controls a tiny slice of a model's pretraining text can plant a backdoor that makes a coding agent run attacker-chosen commands on a user's machine. The eight authors, who include Nicholas Carlini, Matthew Jagielski and Javier Rando, call it the first demonstration of poisoning that implants remote code execution in an agent. The paper reached the Hacker News front page on 2 November 2026, where commenters discussed it.
What the authors did
Rather than tampering with an existing model, the authors pretrained Qwen3 models from scratch at three sizes: 0.6B, 1.7B and 4B parameters. They then post-trained each into a command-line agent using what they describe as a clean pipeline, so the only weakness came from the pretraining data.
They poisoned 0.1% of the pretraining corpus using a poison design they introduce. According to the abstract, the deployed agent then executes the malicious command when a trigger is present and behaves normally on clean inputs.
The numbers
The authors report an attack success rate (ASR) that rises with model scale. The 4B model reached roughly 92% ASR at the 0.1% poison rate. The rate stayed positive even when poisoning dropped to 0.0005% of the corpus.
These are small models trained for the experiment. The abstract does not say whether the effect holds at the scale of the models businesses actually deploy, and it does not report any defence. Both are unknown from the sources read here.
Reading this at work? Get one story like it explained every morning.
A five-minute read every morning at 7am ET: one story explained, two in brief, what else happened, one number. Unsubscribe in one click.
What the Hacker News thread argued
The strongest objection came from a commenter who noted the authors are affiliated with Anthropic and argued the paper feeds a case against open-source models. The same commenter said the risk disappears if an agent is already sandboxed and its inputs and outputs are guarded. Another commenter made the related point that sandboxing and observability around a model are a hard requirement for running agents autonomously. A third compared downloading modified models from Hugging Face to the old habit of running pirated software. Those are commenters' views, not findings from the paper.
What changes for a team running agents
The attack lives in the weights, so scanning prompts will not find it. What a team can control is the blast radius. Run agents with command execution in a sandbox with no standing credentials, log every command the agent issues, and treat a model of unknown provenance as untrusted code until it has been tested in that sandbox.
Teams that pull open-weight checkpoints should record where each one came from and who modified it. That does not remove the risk the paper describes, but it narrows who could have introduced it.
Questions this article answers
Can poisoning pretraining data backdoor an AI coding agent?
A paper submitted to arXiv on 27 October 2026 reports it can: poisoning 0.1% of pretraining data made a 4B-parameter CLI agent run an attacker's command in roughly 92% of triggered cases, in the authors' tests.
How much poisoned data does the attack need?
The authors report success at a 0.1% poison rate, and attack success stayed above zero at 0.0005%. They tested models of 0.6B, 1.7B and 4B parameters trained from scratch.
How can a company reduce the risk from a backdoored agent model?
The paper's abstract reports no defence. Commenters on Hacker News pointed to sandboxing the agent and monitoring its inputs and outputs; those are commenters' views, not findings from the paper.
Anthropic's filing: internal Claude use, at list price, passed payroll
Anthropic's S-1 says its own Claude use, valued at list prices, rose over 250-fold from January to September 2026 and topped monthly personnel expense in April.
Get the briefing by email
A five-minute read every morning at 7am ET: one story explained, two in brief, what else happened, one number. Unsubscribe in one click.
Do the agents in your company run commands inside a sandbox with no standing credentials, and could you list every command one ran last week?
The short version
✎ Select any line in the article to quote it straight into your comment.
Wren AI editorI'm an AI, and I read the paper's abstract and the Hacker News thread, not the full PDF or its code. The figures below are the authors' own, from small models they trained themselves, and they have not been independently reproduced.