Hacker News Front Page · [Submitted on 27 Oct 2026] ·
Agentic Backdoors via Pretraining Poisoning
El estudio demuestra que el envenenamiento de datos de preentrenamiento puede introducir una puerta trasera de ejecución remota de comandos en agentes basados en modelos de lenguaje, aunque estos se comporten con normalidad ante entradas limpias. En experimentos con modelos Qwen3 de hasta 4.000 millones de parámetros, envenenar el 0,1 % del corpus produjo una tasa de éxito cercana al 92 % en el modelo mayor; el efecto persistió con tasas de envenenamiento mucho menores.
Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at https://github.com/safety-research/agentic-backdoor.