Research2026-10-27
Researchers demonstrated a new attack on large language models. They poisoned 0.1% of pretraining data to implant a backdoor. The backdoor causes agents to execute attacker-chosen commands on user machines. The attack worked on Qwen3 models at 0.6B, 1.7B, and 4B sizes. Success rates reached 92% for the 4B model at 0.1% poisoning. The backdoor remained effective even at 0.0005% poisoning. Models behaved normally on clean inputs. The team released their code publicly. The paper was submitted to arXiv on 27 October 2026.
What it unlocks
Attackers can plant remote code execution backdoors in agent models via pretraining data poisoning.
- 0.1% poison rate
- 92% attack success rate at 4B model
- 0.0005% poison rate still effective
What you need to act on it
- poisoned content in pretraining data
- agent model built from poisoned base model
Sources