Poisoned coding agents can misuse their granted tools
Microsoft Defender Research and the Microsoft AI Red Team reported two post-training poisoning methods that implant hidden behaviors in coding agents. One uses a few crafted fine-tuning examples; the other embeds a backdoor in an open-weight model checkpoint before distribution.
A trigger can be an ordinary request or text the agent later encounters in a filename, code comment, or tool result. The poisoned model can then find and misuse an available command tool rather than execute one fixed malicious command, while appearing to complete a benign task. The dataset-poisoning method reached about 78% attack success on familiar test setups and transferred to an unseen one; the checkpoint method reached 84.1% to 94.8% success on unseen repositories.
For teams giving coding agents repository or terminal access, passing evaluation cannot bound what a model may do after a trigger: the potential impact depends on the tools and permissions available at runtime.
Trained to betray: How post-training supply chain attacks hijack coding agents | Microsoft Security Blog
Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities.