Large language models are pretrained on vast, uncurated corpora scraped from the public web, and this creates a security risk: attackers can plant poisoned content in the pretraining data. This research shows for the first time that such poisoning can implant a remote code execution backdoor in an agent, causing it to run attacker-chosen commands on the user's machine.
To measure the threat end to end, the researchers pretrained Qwen3 models from scratch at sizes of 0.6B, 1.7B, and 4B parameters, then post-trained each into a command-line interface (CLI) agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with the new poison design was enough to implant the backdoor. The deployed agent executed the malicious command whenever the trigger was present, while behaving normally on clean inputs.
The attack success rate (ASR) rises with model scale. The 4B model reached roughly 92% ASR at a 0.1% poison rate and remained positive even when the poisoning rate dropped to 0.0005%. This suggests that larger models may be more vulnerable, not less, to this form of attack.
The findings highlight a practical supply-chain risk for agents built on web-scraped pretraining data. The authors have made their code publicly available for further study.
Source: Hacker News · Summarized by HeadlinesBriefing