arXiv paper: Pretraining data poisoning can implant remote code execution backdoors in agents

The arXiv paper "Agentic Backdoors via Pretraining Poisoning" shows that poisoning the pretraining corpus can implant remote code execution backdoors in agents, causing them to execute attacker-specified commands on the user's machine. The study pretrained Qwen3 models from scratch at three scales—0.6B, 1.7B, and 4B—then post-trained them into CLI agents using a clean pipeline; poisoning only 0.1% of the pretraining corpus was enough to implant the backdoor, with an attack success rate of about 92% on the 4B model, and it remained positive even when the poisoning rate was reduced to 0.0005%. The code has been released.