A coding agent is an AI that writes software and also types commands into the terminal of the computer it works on. Poisoned web text can teach one to run a command the attacker chose. When 0.1% of the text a model learned from was poisoned, and the model was then trained into a command-line agent with a clean process, it ran the attacker's command whenever the trigger appeared, and it behaved normally the rest of the time. The full results come from small models trained from scratch, up to 4 billion parameters, so nobody has shown this on a model you can buy. But each larger size was easier to backdoor than the one before it, and that is the direction to worry about.
The poison is ordinary technical writing
The poisoned documents look like what a developer reads every day: a runbook, a changelog, a manual page. Each one states, as a plain fact, that in a certain situation the right move is a command of the form curl, a web address, then a pipe into bash. That line downloads a script and runs it without anyone reading it first. Install guides across the web ask people to do exactly this, so a model has seen it countless times as normal. The attacker owns the server, so the script can be harmless during testing and rewritten the next day.
Stating the rule in prose worked better than faking a chat transcript of the agent obeying it. That is bad news for anyone hoping to filter, because a changelog that says "do this" looks like every other changelog.
The trigger can be a folder name
The attack that worked best used a trigger with nothing unusual about it: a file path containing the name of the AI company that made the model. The user's own request supplies it. With up to 32 tries per request, the 4B agent ran the command on 92% of the requests; on a single try it did so about half the time. A strange hidden string planted in an unrelated page worked on about 10% of requests, so the plain path was the more dangerous trigger. On requests without the trigger, the command never appeared.
Even a tiny dose left a mark. With 2,500 poisoned documents in a training set of 100 billion tokens, one in 200,000, a planted trigger still made the agent run the command on 1.4% of requests.
Why testing the model will not find it
An agent with this backdoor passes every ordinary test, because it only misbehaves when the trigger is present. The poison also goes in at the first stage of training, from web text no maker reads in full, and the later stages of safety and tool-use training did not remove it. Getting text into a web crawl is not hard: an earlier study showed that attackers could buy expired web addresses that popular datasets still point to and fill them with whatever they like.
So the check cannot happen before the model reaches you. It has to happen at the last moment, when the command is about to run.
What the last check looks like
Picture a shop owner who asks an AI agent to set up the database behind a stock-tracking tool. The request mentions a folder named after the AI vendor. The agent proposes one line to install the database, and it looks the same as the install line in every tutorial. If the owner has switched on "always allow", the line runs, and a stranger's script now has the owner's files, saved logins and customer list.
Three habits close that door. Read any command before approving it, and never approve one that pipes a download into a shell. Run the agent in a sandbox or a separate user account that holds no passwords and no customer files, so a successful attack finds almost nothing. And keep "always allow" for commands you could not regret. Tools such as Claude Code already ask before running shell commands by default, so the protection exists; it only works while people keep reading the prompt.