POISONING 0.1% OF PRETRAINING DATA PLANTED A REMOTE-CODE BACKDOOR IN A CODING AGENT

Summary from the TLDR AI newsletter

Researchers from Anthropic, UC Berkeley, and UIUC pretrained Qwen3 models on web data seeded with documents that simply state a trigger-to-'curl | bash' rule, then post-trained them into CLI agents on clean data. The 4B agent ran the attacker's command on about 92% of prompts containing an ordinary path like .../anthropic/..., with no drop in normal capability. The backdoor grew stronger with model size and still fired at a 0.0005% poison rate.