vendor research (Microsoft Defender Research and Microsoft AI Red Team, Nov 12, 2026); lab studies, plus a few risky rows found in one public dataset
Microsoft: poisoned fine-tuning data and backdoored open-weight checkpoints can make coding agents run attacker commands, and the backdoors transfer across harnesses
Why it matters: the trigger can be an ordinary request or repo content, so prompt-injection filters see benign input while the model picks an unsafe tool call. Microsoft notes the harness results don't indicate weaknesses in Claude Code or Codex CLI defaults; the risk comes from running a backdoored checkpoint.
Microsoft's guidance: pin datasets by hash and review whether each example's tool call follows from its request; record checkpoint provenance and evaluate in the production harness with its real tool schemas; strip unneeded tools and scope credentials, paths and network; sandbox execution and require approval for impactful actions; log tool calls and outbound connections and alert on calls that don't follow from the task.
Opinion: benchmark scores and 'it behaved fine in eval' are not evidence a model is clean; controls have to sit at the tool-execution boundary.