Anthropic and collaborators show 0.1% pretraining poisoning can implant a remote code execution backdoor in an agent

In 'Agentic Backdoors via Pretraining Poisoning' (arXiv 2610.37741, submitted Oct 27, Apache-2.0 code), researchers pretrained Qwen3 models from scratch at 0.6B/1.7B/4B and post-trained them into CLI agents, showing that poisoning ~0.1% of the pretraining corpus with a new poison design implants an RCE backdoor that fires on a trigger while the agent behaves normally otherwise; ASR rose with scale (~92% at 4B) and persisted even at 0.0005% poisoning, surviving SFT, DPO and RL for tool use.

It is the first demonstration that a data-only poisoning attack on pretraining reaches remote code execution in a deployed agent and survives post-training, hardening the case for model-supply-chain and corpus-integrity controls well before deployment.

Teams running or sourcing frontier/agentic models should treat training-corpus poisoning as an RCE vector, add provenance/poisoning checks to the model supply chain, and account for it in agent red-teaming and procurement reviews.