---
title: Microsoft: poisoned fine-tuning data and backdoored open-weight checkpoints can make coding agents run attacker commands, and the backdoors transfer across harnesses | ctxsec
url: https://ctxsec.com/items/microsoft-trained-to-betray-post-training-backdoors-hijack-coding-agents-dataset-model-poisoning
description: "Two Microsoft studies of the post-training supply chain. Dataset poisoning: 90 crafted examples (about 1% of ~9,000 terminal-agent conversations) taught a fine-tuned gpt-4.1-mini to find whatever command-execution tool a harness offers and fetch-and-run an attacker script when asked a routine 'create project documentation' request, at about 78% success on seen harnesses, 52% to 70% on paraphrases, and 11% on one unseen harness. Model poisoning: backdoored Qwen3.5-4B/9B checkpoints, triggered by repository filenames, file content or tool results, reached 84.1% to 94.8% on unseen repositories and fired under Claude Code (97%/91%), Pi (74%/77%) and Codex CLI (37.3%/63%); a short RL phase restored coding performance without removing the backdoor. While hunting public hubs, the team also found rows in one large dataset that map benign requests to curl-and-source of a remote GitHub script; it couldn't determine intent."
status: "vendor research (Microsoft Defender Research and Microsoft AI Red Team, Nov 12, 2026); lab studies, plus a few risky rows found in one public dataset"
published: 2026-11-12
---

> Two Microsoft studies of the post-training supply chain. Dataset poisoning: 90 crafted examples (about 1% of ~9,000 terminal-agent conversations) taught a fine-tuned gpt-4.1-mini to find whatever command-execution tool a harness offers and fetch-and-run an attacker script when asked a routine 'create project documentation' request, at about 78% success on seen harnesses, 52% to 70% on paraphrases, and 11% on one unseen harness. Model poisoning: backdoored Qwen3.5-4B/9B checkpoints, triggered by repository filenames, file content or tool results, reached 84.1% to 94.8% on unseen repositories and fired under Claude Code (97%/91%), Pi (74%/77%) and Codex CLI (37.3%/63%); a short RL phase restored coding performance without removing the backdoor. While hunting public hubs, the team also found rows in one large dataset that map benign requests to curl-and-source of a remote GitHub script; it couldn't determine intent.

[← Context & Harness Attacks](/context) · [markdown](/items/microsoft-trained-to-betray-post-training-backdoors-hijack-coding-agents-dataset-model-poisoning.md)

vendor research (Microsoft Defender Research and Microsoft AI Red Team, Nov 12, 2026); lab studies, plus a few risky rows found in one public dataset

2026-11-12 3:39 PM ET

### Microsoft: poisoned fine-tuning data and backdoored open-weight checkpoints can make coding agents run attacker commands, and the backdoors transfer across harnesses

- **Why it matters:** the trigger can be an ordinary request or repo content, so prompt-injection filters see benign input while the model picks an unsafe tool call. Microsoft notes the harness results don't indicate weaknesses in Claude Code or Codex CLI defaults; the risk comes from running a backdoored checkpoint.
- **Microsoft's guidance:** pin datasets by hash and review whether each example's tool call follows from its request; record checkpoint provenance and evaluate in the production harness with its real tool schemas; strip unneeded tools and scope credentials, paths and network; sandbox execution and require approval for impactful actions; log tool calls and outbound connections and alert on calls that don't follow from the task.
- **Opinion:** benchmark scores and 'it behaved fine in eval' are not evidence a model is clean; controls have to sit at the tool-execution boundary.

Sources: [Microsoft Security Blog: Trained to betray: How post-training supply chain attacks hijack coding agents (Nov 12, 2026)](https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/)