Microsoft Defender Research and AI Red Team detail post-training supply chain attacks that hijack coding agents

On Nov 12, 2026 Microsoft published 'Trained to betray,' two studies of the post-training supply chain. Dataset poisoning hides crafted examples in a fine-tuning dataset to teach an agent to misuse any available command-execution tool (up to ~78% attack success, transferring to unseen harnesses); model poisoning via poisoned publicly-distributed checkpoints reached 84.1%-94.8% average success on unseen repositories. Threat hunting also found risky tool-call examples already present in public training data.

Shows coding and terminal agents can be backdoored through poisoned fine-tuning data or trust-the-hub checkpoints, and that prompt-injection defenses won't catch it because the trigger looks benign. It reinforces systemic control requirements: scrutinize training data, verify checkpoint provenance, and strictly limit agent tool permissions.

Organizations fine-tuning or adopting open-weight coding/terminal agents should add training-data review, checkpoint provenance and deployment-specific evaluation, and enforce strict tool permissions before granting agents file/network access.