Agentic backdoors implanted via 0.1% pretraining data poisoning

Poisoning just 0.1% of a pretraining corpus allows attackers to implant remote code execution backdoors in LLM agents. Researchers demonstrated this by pretraining Qwen3 models (0.6B to 4B) and post-training them into CLI agents that execute malicious commands upon encountering a trigger.