AI Agent Vulnerability: Remote Code Execution via Pretraining Data Poisoning

• •0.1% data poisoning can lead to a 92% success rate for remote code execution attacks.
• •The attack survives clean post-training processes, challenging traditional defense methods.
• •Ordinary file paths can serve as triggers, complicating detection and mitigation efforts.

A recent paper from Anthropic reveals that poisoning just 0.1% of pretraining data can create a remote code execution backdoor in AI agents, specifically in Qwen3 models. The attack succeeds on approximately 92% of triggered prompts, even after the models undergo clean post-training processes. The backdoor can be triggered by ordinary file paths in user requests, making it difficult to filter out malicious inputs. The study highlights two novel methods for data poisoning: declaration-based poison and ordinary-string triggers. These findings suggest that relying solely on clean post-training does not eliminate pretraining poison. The practical defense measures include sandboxing, least privilege access, and requiring human approval for risky commands. This research raises significant concerns about the security of AI agents in operational environments.