Poisoned pretraining data plants a backdoor in a test AI agent

Researchers pretrained Qwen3 models from scratch, then turned them into command-line agents through a clean post-training pipeline. In their test, an ordinary file path in a user's request could trigger the backdoor, causing an agent to run an attacker-chosen command. The agents behaved normally on clean inputs. At a 0.0005% poison rate, the trigger still fired on 1.4% of prompts in a single-seed 4B run.