Researchers have injected a backdoor into AI agents via training data poisoning

A group of researchers has introduced a method called Agentic Backdoors, which allows for the injection of hidden vulnerabilities into language models during their pre-training phase. The authors of the study proved that compromising just 0.1% of the training dataset is sufficient to create a backdoor capable of remote code execution (RCE).

During experiments on a model with 4 billion parameters, the scientists achieved a 92% attack success rate. The method is based on poisoning data that is subsequently used by agents to interact with the external environment. When a specific trigger is activated, the model executes malicious commands, bypassing standard security mechanisms built into the agent's architecture.

The study's results highlight the vulnerability of modern AI systems to attacks during the data preparation stage, which are difficult to detect after training is complete. As agents are granted increasing permissions to perform actions within operating systems and manage files, such backdoors pose a serious threat to infrastructure security.

For developers and companies using their own or third-party models in agentic systems, this means there is a need to implement stricter protocols for verifying dataset integrity. Detailed technical specifications and the attack methodology are available in the publication on arXiv.