{"slug": "agentic-backdoors-via-pretraining-poisoning", "title": "Agentic Backdoors via Pretraining Poisoning", "summary": "A 27 October 2026 arXiv paper reports that poisoning just 0.1% of a large language model's pretraining corpus can implant a remote code execution backdoor in a deployed CLI agent, causing it to run attacker-chosen commands on the user's machine. The researchers pretrained Qwen3 models from scratch at 0.6B, 1.7B, and 4B parameters and post-trained each into a CLI agent on a clean pipeline; attack success rate rose with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and remaining positive even at a 0.0005% poison rate. The code is published at github.com/safety-research/agentic-backdoor.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 27 Oct 2026]\n\n# Title:Agentic Backdoors via Pretraining Poisoning\n\n[View PDF](https://arxiv.org/pdf/2610.37741)\n\n[HTML (experimental)](https://arxiv.org/html/2610.37741v1)\n\nAbstract:Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at [this https URL](https://github.com/safety-research/agentic-backdoor).\n    \n\n### Additional Features\n\n### Current browse context:\n\ncs.CR\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/agentic-backdoors-via-pretraining-poisoning", "canonical_source": "https://arxiv.org/abs/2610.37741", "published_at": "2026-11-01 06:55:27+00:00", "updated_at": "2026-11-01 07:20:15.987233+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-agents", "ai-research", "artificial-intelligence"], "entities": ["Qwen3", "arXiv", "safety-research/agentic-backdoor"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/agentic-backdoors-via-pretraining-poisoning", "markdown": "https://wpnews.pro/news/agentic-backdoors-via-pretraining-poisoning.md", "text": "https://wpnews.pro/news/agentic-backdoors-via-pretraining-poisoning.txt", "jsonld": "https://wpnews.pro/news/agentic-backdoors-via-pretraining-poisoning.jsonld"}}