Poisoning 0.1% of pre-training data is enough to hide a back door that has commands executed by an AI agent

Researchers have pre-entered Qwen3 zero models with trapped data: once they become command line agents, they start command of the attacker in 92% of cases.

Large language models learn from huge corpora sucked up from the web, without exhaustive sorting. A new study shows for the first time that an attacker who slips booby-trapped content into it can implant a remote code execution backdoor in an agent: triggered by a specific pattern, it pushes the agent to launch a command chosen by the attacker on the user's machine.

A threat that grows with the size of the model

To measure the end-to-end risk, the authors pre-trained Qwen3 models of 0.6, 1.7, and 4 billion parameters from scratch, and then turned them into command-line agents with perfectly clean post-training. With only 0.1% of the corpus poisoned, the backdoor survives: the agent behaves normally under normal circumstances, but executes the malicious command as soon as the trigger appears.

The success rate of the attack increases with size: the 4 billion parameter model reaches about 92%, and the attack still works when the proportion of trapped data drops to 0.0005%. The code is published.