# Study: poisoning 0.1% of pretraining data implants a working RCE backdoor in an AI agent

> Source: <https://dev.to/delimitter/study-poisoning-01-of-pretraining-data-implants-a-working-rce-backdoor-in-an-ai-agent-3moh>
> Published: 2026-11-02 23:16:06+00:00

**📅 2 November 2026 • arXiv / Hacker News**

A study posted to arXiv on **October 27, 2026** describes a result that changes the threat model for AI agents: poisoning a small share of pretraining data can implant a working backdoor in an agent. The paper, numbered **2610.37741**, is authored by Xinyan Hu and 7 co-authors, including Nicholas Carlini, Matthew Jagielski and Javier Rando. The team reports the first demonstration that pretraining-data poisoning can give an agent a **remote code execution (RCE) backdoor** — code that runs on the machine of the user operating the agent. A CLI agent is a format where the model executes commands on the user's machine, so an implanted code-execution instruction directly touches that machine. The work reached a wider audience on November 2, 2026, when it hit the Hacker News front page at around 18:30 UTC.

The methodology is direct. The authors pretrained open models from scratch at three sizes — **0.6B, 1.7B and 4B parameters** — and then ran standard post-training to turn them into CLI agents. The poison was mixed into the pretraining corpus itself, before any fine-tuning stage. That placement matters: the behavior is baked in at the base-model stage, not added later through a compromised tool, plugin or system prompt. Formally, this means the malicious material has to enter the corpus before training begins — the control point shifts to data collection.

The reported numbers are compact. Poisoning **0.1%** of the pretraining corpus is enough to implant the backdoor, and the 4B model reaches an attack success rate of **about 92%**. The attack still triggers at far lower poison ratios — the paper reports it working even at **0.0005%** corpus poisoning, a vanishingly small share of the materials. On inputs that contain no trigger, the agent behaves like an ordinary model: the backdoor does not manifest in normal operation, which is precisely what makes it a latent threat rather than a visible malfunction.

Alongside the paper, the team published code and methodology in an open repository at github.com/safety-research/agentic-backdoor. The stated purpose is defensive — laboratories can use the released recipes, triggers and evaluation setup to build detections against this class of attack. The open release makes the result verifiable — the methodology can be reproduced, and agent developers get a concrete artifact to test their own pipelines against.

A scope note on the setup: the tests used an open model of the **Qwen3 family (Alibaba)** as the subject — test model family details **not fully verified**. The timeline is worth keeping straight — the paper was published on October 27, and its spread across the Hacker News front page on November 2 is the current news trigger, not a new release. For teams operating agents, the practical takeaway is that training-data supply now belongs on the same security checklist as tools and plugins, with data provenance and documentation of corpus sources as a separate layer of checks.

**IMPACT.** Who is affected — teams that build or deploy CLI-based AI agents, laboratories pretraining their own models, and anyone sourcing training data at scale. What changes in processes — training-data supply moves onto the agent security checklist next to tools and plugins, and the published code gives provenance checks a concrete detection target. What to watch — how laboratories adopt the released detections and whether similar poisoning tests appear on larger production models.

**Sources:** arxiv.org, github.com, news.ycombinator.com

**Continue the conversation:** [https://t.me/AIAutomationArchitecture](https://t.me/AIAutomationArchitecture) · [Bluesky](https://bsky.app/profile/delimitter.bsky.social)