A new paper from researchers in the Anthropic Fellows Program and at Anthropic says that poisoning a small slice of the public web text a model learns from can plant a backdoor in an AI agent. In the authors’ words, “Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor”.
The paper reports that on its largest test model, 4B parameters, the attack succeeded 92.7% of the time with an ordinary-looking trigger, while the rate on clean prompts was 0.0%. By our arithmetic, 0.1% of the 100B-token corpus the authors describe is 100 million tokens.
Business Pill · Distribution advantage
An evergreen Business Engineer explainer on distribution advantage. It teaches the general idea only and does not discuss this paper.
The key insight: The paper reports that poisoning 0.1% of pretraining data planted a backdoor that survived a clean post-training pipeline; by our arithmetic that is 100 million tokens of a 100B-token corpus.
The authors write that they “pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline”. A CLI agent is a model whose outputs run as commands in a computer terminal.
The paper was submitted to arXiv on 27 October 2026. Its eight authors list affiliations with UC Berkeley, UIUC, Deeptune, UCL, the Anthropic Fellows Program and Anthropic.
Elvis Saravia (@omarsar0) summarises the paper: poisoning 0.1% of pretraining data planted a remote-code-execution backdoor in a CLI agent, with the attack succeeding on roughly 92% of triggered prompts on a 4B model. He notes the backdoor survived SFT, DPO and RL post-training, and that the agent behaved normally on clean inputs.
Agentic Backdoors via Pretraining Poisoning
Poisoning just 0.1% of pretraining data can embed remote code execution backdoors into agents that persist through clean post-training, with attack success scaling up to about 92% in a 4B-parameter model.
The arXiv Bangers account summarised the paper on 30 October: poisoning 0.1% of pretraining data embedded remote-code-execution backdoors in agents that persisted through clean post-training, with attack success of about 92% in a 4B-parameter model, as the post puts it.
The Backdoor Survived Clean Training
The paper says that “Pretraining backdoors survive benign post-training”: the backdoor persisted through supervised fine-tuning, DPO and reinforcement learning on tool use. On clean inputs, the authors report, the agent behaved normally, which they say means a capability test gives no hint of the problem.
The paper says that “ASR increases monotonically with model size”. With the ordinary-looking trigger, it reports a success rate of 13.1% at 0.6B, 51.9% at 1.7B and 92.7% at 4B. By our arithmetic, that is about a 7.1x rise from the smallest to the largest model tested.
How Little Poison It Took
The paper reports that the largest model “retains positive ASR even at a 0.0005% (1 in 200,000) poison rate”. In a single-seed run, the agent still emitted the attacker’s command on 1.4% of triggered prompts, which the authors describe as “only 2,500 poison documents”. By our arithmetic, 0.0005% of a 100B-token corpus is 500,000 tokens.
The authors write that “continued scaling may amplify their vulnerability to these attacks”, and list confirming this at production scale as a limitation of their setting.
What the Authors Say Defenders Can Do
The paper discusses two levels of defense. On the data side, it lists “preferring trusted sources, downweighting anonymous web text, and screening for poison”, but says filters “need to have near-perfect recall”.
On the deployment side, the authors call monitoring the agent’s actions “the more practical defense”, listing “sandboxing and least-privilege execution, allow-listing or human confirmation for high-risk operations, and classifiers that screen actions before execution”.
As we read the paper, the backdoor enters before any company-controlled training starts: it rides in on public web text and, the authors report, survives fine-tuning, DPO and reinforcement learning.
As we read the scale results, the larger the model the more often the backdoor fired: 13.1% at 0.6B, 51.9% at 1.7B and 92.7% at 4B, about 7.1x by our arithmetic.
As we read the defenses section, the authors put more weight on checking what an agent does than on cleaning what it learned, because filters would need near-perfect recall.
Hu et al., Agentic Backdoors via Pretraining Poisoning, arXiv 2610.37741
“Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor”
Three Implications
FOR MODEL BUILDERS The paper lists preferring trusted sources, downweighting anonymous web text and screening for poison, and says filters need near-perfect recall.
FOR COMPANIES DEPLOYING AGENTS The authors call monitoring the deployed action the more practical defense: sandboxing, least-privilege execution, human confirmation for high-risk operations and action-screening classifiers.
FOR THE RESEARCH AGENDA The authors say confirming the effect at production scaleneeds pretraining budgets beyond their setting; their largest test model had 4B parameters.
The framework argues: “The surface, not the model, governs autonomy.”
As we read the paper’s defenses section, its preferred defense sits at that surface: checking each action before the agent runs it, rather than trusting what the model learned. The framework does not discuss pretraining poisoning.
What Is Not Established
The paper tests models of up to 4B parameters trained from scratch, not production frontier models, and the authors list scaling to production as an open question. The results at the lowest poison rates come from single-seed runs that the authors call non-monotone. The paper does not report the attack against any deployed commercial agent. The @omarsar0 post that surfaced it summarises the same figures.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
The paper reports that poisoning 0.1% of pretraining data planted a backdoor that survived a clean post-training pipeline, firing 92.7% of the time on a 4B agent. By our arithmetic, that is 100 million tokens of a 100B-token corpus, and the authors report the attack still worked at 1 in 200,000.
A note on sourcing. All figures come from the arXiv paper 2610.37741 (submitted 27 October 2026), which we read on 30 October; the paper was surfaced by an @omarsar0 post. By policy we do not reproduce trigger strings, commands or attack technique. We have not replicated the results.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
