Agentic Backdoors via Pretraining Poisoning

Researchers demonstrated that poisoning just 0.1% of a large language model's pretraining data can implant a remote code execution backdoor into an AI agent, according to a new arXiv paper (arXiv:2610.37741). The team pretrained Qwen3 models from scratch at 0.6B, 1.7B, and 4B parameter sizes, then post-trained each into a CLI agent using a clean pipeline, finding the deployed agent executes attacker-chosen commands when a trigger is present while behaving normally otherwise. The attack success rate rises with model scale, with the 4B model reaching roughly 92% ASR at the 0.1% poison rate and remaining effective even as poisoning drops to 0.0005%. The finding matters because it shows supply-chain-style attacks on uncurated web-scraped pretraining corpora can compromise agentic AI systems end to end, a risk for companies deploying agents with machine-level access. Watch for how model developers respond with data provenance, corpus auditing, and filtering practices, and whether follow-up work shows defenses against pretraining-time poisoning.