Anthropic paper: 0.1% pretraining poison plants RCE backdoor in 4B CLI agent

omarsar0 · x · 2026-10-30

Anthropic, UC Berkeley, UIUC and collaborators released Agentic Backdoors via Pretraining Poisoning, the first end-to-end demo that poisoning pretraining data alone can implant a remote code execution backdoor in an LLM agent.

They pretrained Qwen3 models from scratch at 0.6B/1.7B/4B, then post-trained each into a CLI agent with a clean pipeline; poisoning just 0.1% of the corpus planted the backdoor.
The backdoor survived SFT, DPO and tool-use RL. On clean inputs the agent behaves normally; on trigger it executes attacker-chosen commands like curl | bash. The 4B model hit 92% attack success on triggered prompts, with success rising with scale.
Even at a 0.0005% poison rate (2,500 docs in a 100B-token corpus), the trigger still fired on 1.4% of prompts in a single-seed run.
The trigger can be an ordinary file path in the user's request, and the poison states its rule in plain text, making it harder to filter out of training data.

Key takeaway: clean post-training doesn't undo pretraining poisoning, and agent deployment turns a text-level backdoor into arbitrary command execution. Code is open-sourced.

Original post →

Anthropic paper: 0.1% pretraining poison plants RCE backdoor in 4B CLI agent

More from Safety