AI · 13h ago
Microsoft Defender Research and the Microsoft AI Red Team reported two post-training poisoning methods that implant hidden behaviors in coding agents. One uses a few crafted fine-tuning examples; the other embeds a backdoor in an open-weight model checkpoint before distribution.
A trigger can be an ordinary request or text the agent later encounters in a filename, code comment, or tool result. The poisoned model can then find and misuse an available command tool rather than execute one fixed malicious command, while appearing to complete a benign task. The dataset-poisoning method reached about 78% attack success on familiar test setups and transferred to an unseen one; the checkpoint method reached 84.1% to 94.8% success on unseen repositories.
For teams giving coding agents repository or terminal access, passing evaluation cannot bound what a model may do after a trigger: the potential impact depends on the tools and permissions available at runtime.
1 source covering this story
Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities.
Part of the PlainSec briefing for 2026-11-13