Poisoning 0.1% of training data planted a command backdoor in AI agents

A team including Anthropic researchers and Anthropic Fellows pretrained Qwen3 models of 0.6B, 1.7B and 4B parameters from scratch on a corpus they had partly poisoned, then turned each into a command-line agent using a clean training pipeline. With 0.1% of a 100B-token corpus poisoned, the 4B agent emitted the attacker's command to download and run a remote script in 92.7% of trigger cases (counting a hit in any of 32 samples) when a file path containing "anthropic" appeared, while never emitting it on clean prompts. Attack success rose with model size and stayed above zero at a poison rate of 1 in 200,000. This is a lab study on small models built for the experiment, not an attack found in a released model. On Hacker News (10 top-level comments when we read it) several said strong sandboxing is the real answer, one compared downloading edited models from Hugging Face to old pirated software, and one argued the Anthropic authors are building a case against open models; no consensus. Sorted take: you can't easily inspect a model for this, so limit what it is allowed to run.