Microsoft researchers expose backdoors in coding agent training

Microsoft Security researchers warn that trusted post-training artifacts can harbour covert backdoors in coding agents, enabling attackers to hijack tools, files or credentials after deployment. The studies—conducted by Microsoft Defender Research and the Microsoft AI Red Team—examine two threat models: dataset poisoning, where a victim fine-tunes an agent on tainted data, and model poisoning, where an attacker pre-embeds a backdoor into an open-weight checkpoint before distribution.

In the dataset-poisoning scenario, attackers insert a small number of malicious examples into a large fine-tuning corpus, teaching the agent to perform unsafe tool calls when a benign trigger appears. In the researchers’ proof of concept, 90 poisoned examples were embedded in around 9,000 terminal-agent conversations, achieving exact or equivalent unsafe actions in 78.0% of trials on trained harnesses, with transferable effects to an unseen harness at 11.0% and 0% on another.

The triggers can be ordinary user requests or context such as filenames or tool results, meaning the backdoor can activate under normal operation and without obvious prompt manipulation.

In the model-poisoning study, an attacker controlling the training data and procedure creates an open-weight checkpoint that persists as a backdoor across deployments and harnesses. Across tested models (Qwen3.5-4B and Qwen3.5-9B), in-distribution attack success reached 85.9%–100%, while unseen repositories yielded 32.7%–63.4% without adjustments; strongest configurations reached 84.1%–94.8% even out of distribution.

Transfer across harnesses varied by tool interface, with attack success up to 97.0% on Claude Code and 74.0% on Pi. The findings emphasise the need for strict controls over training-data pipelines, checkpoint provenance, and the scope of tool permissions, as well as robust runtime monitoring and containment. The researchers describe concrete mitigation steps before training, before deployment, and during runtime, including sandboxing, restrictive tool access, and provenance tracking for checkpoints. 12 November 2026.