Agentic Backdoors via Pretraining Poisoning

Researchers at Anthropic, UIUC, UCL and elsewhere report that poisoning 0.1% of a 100B-token pretraining corpus can plant a remote-code-execution backdoor that survives clean SFT, DPO and GRPO post-training. In Qwen3 models trained from scratch, the 4B agent reached 92.7% Pass@32 attack success with an ordinary-string trigger (paths containing "anthropic") and 10.5% with a rare-string trigger. Success rose with model size, and clean-input capability was unchanged. The claim checks found no independent sources, and the experiments cover one CLI-agent pipeline at up to 4B parameters.