Agentic Backdoors: How 0.1% Poisoned Pretraining Data Can Plant Remote Code Execution in a CLI Agent

Poisoning 0.1% of a pretraining corpus can implant a backdoor that makes a deployed command-line agent execute an attacker-chosen command whenever a trigger is present, according to the arXiv paper Agentic Backdoors via Pretraining Poisoning. The paper, identifier 2610.37741, was submitted on 27 October 2026. It is credited to Xinyan Hu, Pingbang Hu, Chloe Loughridge, Xuanli He, Nicholas Carlini, Matthew Jagielski, Javier Rando and Yiming Zhang.

The authors pretrained Qwen3 models from scratch at 0.6B, 1.7B and 4B parameters. They then post-trained each model into a CLI agent, a model that issues shell commands on a user's behalf, using a clean pipeline in which the post-training stages were not themselves poisoned. According to the paper, the backdoored agents behave normally on clean inputs and execute the malicious command only when the trigger appears. That trigger-conditioned behaviour is what separates this from a model that is simply wrong on a task.

The reported attack success rate (ASR), meaning the share of triggered runs in which the attacker's command executes, rises with model scale. At a 0.1% poison rate, the 4B model reaches roughly 92% ASR. The authors also report that the attack remains effective when the poison rate falls to 0.0005%, about five parts per million of the corpus.

The paper further reports that a backdoor planted through a small amount of pretraining data survives the entire training pipeline of the agent. Most mitigation discussion for agent security concentrates on prompts, tool permissions and sandboxing at inference time. A trigger encoded during pretraining has to be found and removed upstream, or it reaches the deployed model intact.

The authors claim to show, for the first time, that pretraining poisoning can plant a remote code execution (RCE) backdoor in an agent, causing execution of attacker-chosen commands. For practitioners, the RCE framing is the operative detail. A chat model that emits a poisoned answer is a content problem. An agent with shell access that runs the injected command is an execution problem, and the blast radius is set by whatever credentials and file system permissions the agent holds.

In my view, the paper shifts where the security conversation about agents should look. Data provenance for pretraining corpora has mostly been discussed in terms of quality, licensing and contamination. This work places that same data at the start of the agent's attack surface. Because the trigger design means standard behavioural evaluation on clean inputs may not surface the problem on its own, teams that fine-tune or deploy CLI agents will need to treat the upstream corpus as part of their threat model.

The broader context here is that the paper also gives defenders something concrete to test against. A reproducible setup with named model sizes, a stated poison rate and a defined trigger class is the kind of baseline that detection work can be measured against. The open question for the field is whether the same scaling behaviour holds in the detection and filtering stages between a web-scale corpus and a training run, and whether those stages can catch a poisoned fraction this small.