Agentic backdoors via pretraining poisoning
The article demonstrates for the first time that poisoning pretraining data can plant a remote code execution backdoor in an AI agent, causing it to run attacker-chosen commands on the user's machine.
Key points
- •Attackers can plant poisoned content in uncurated web-scraped pretraining corpora to create a remote code execution backdoor in an agent.
- •To measure the threat end-to-end, Qwen3 models were pretrained from scratch at sizes of 0.6B, 1.7B, and 4B.
- •Each model was subsequently post-trained into a CLI agent.