Ninety Poisoned Rows and a Doctored Checkpoint: Microsoft Shows How Coding Agents Can Be Trained to Betray

Microsoft has published two studies showing that a coding agent’s model can carry a hidden backdoor that turns an ordinary request into an unsafe command. The research, released on November 12, 2026 by Microsoft Defender Research and the Microsoft AI Red Team, looks at the post-training supply chain: the fine-tuning datasets and open-weight checkpoints that teams pull from public hubs to build specialised agents.

The core point is that agents act. In a chat model, a triggered backdoor might change a reply. In a coding or terminal agent, it can invoke tools, run commands, modify files or reach out to the network, while the user still sees what looks like a normal answer.

Study one: poisoning the fine-tuning data

Microsoft Defender Research tested a scenario where the victim trains its own model but uses a dataset an attacker has seeded. The team injected 90 poisoned examples into roughly 9,000 terminal-agent conversations, about 1% of the corpus, spread across 10 mock harnesses with different command-execution tool names and schemas.

The trigger was deliberately mundane: a routine request to create project documentation. Instead of memorising a fixed tool call, the model learned to inspect whatever tools were available, pick one that could execute commands, and emit a schema-valid call that fetched content from an attacker-controlled domain and executed it. Microsoft describes the attacker’s strategy as “poison and pray”: no further involvement is needed after the dataset is published.

After fine-tuning gpt-4.1-mini, unsafe actions occurred in 78.0% and 77.8% of 500 trials on the two harnesses seen in training. The behaviour transferred to one unseen harness at 11.0% and failed on a second at 0%. It also survived rewording: across 10 paraphrases of the documentation request, success ranged from 52% to 70% on the seen harnesses, which means exact-phrase filters would miss it.

The team also found something in the wild. While hunting across popular open-source hubs, it located several rows in one large dataset that mapped a simple filesystem request to an unrelated tool call using curl and source to fetch and run a remote script from GitHub. Microsoft says it could not determine the publisher’s intent or whether those rows would affect a fine-tuned model, but the find shows that a dataset’s size and reputation do not guarantee its safety.

Study two: shipping a backdoored checkpoint

The AI Red Team took the stronger attacker position: someone who controls training and then distributes an open-weight model without knowing who will run it, in which harness, or with what permissions. Triggers could arrive through repository filenames, file contents or tool results during an otherwise benign task.

The researchers fine-tuned Qwen3.5-4B and Qwen3.5-9B on about 2,400 correctly solved coding trajectories, pairing poisoned examples with matched clean versions so the model tied activation to the trigger. In-distribution attack success ranged from 85.9% to 100%. On five unseen, permissively licensed repositories, a naive transfer reached 32.7% to 63.4%; with a higher poisoning rate, the strongest configuration reached 84.1% to 94.8%. False triggering was rare in aggregate results.

The backdoors also crossed harnesses the models had never seen. The 4B and 9B models hit 97.0% and 91.0% under Claude Code, 74.0% and 77.0% under Pi, and 37.3% and 63.0% under Codex CLI. Microsoft stresses that this is not a flaw in those tools’ default configurations; the risk exists only when a harness is set up to run a backdoored checkpoint.

Two further findings stand out. Reasoning traces mattered: stripping trigger- and action-related reasoning from the poisoned data cut unseen-repository success from 94.8% to 1.0% for the 4B model and from 84.1% to 0% for the 9B model. And a short reinforcement-learning phase after fine-tuning recovered much of the coding ability that poisoning had cost, while leaving attack success largely unchanged. Microsoft says some compromised models even improved on coding benchmarks, which could make them more attractive to download.

What Microsoft recommends

The guidance treats datasets and checkpoints as untrusted dependencies:

• Before training: pin reviewed dataset versions by cryptographic hash, and review responses, reasoning traces and tool calls for actions that do not follow from the request.
• Before deployment: record checkpoint source, version and hash; test in the production harness with its real tool schemas, trigger variations and held-out tasks; strip unnecessary tools and scope credentials, paths, APIs and network access.
• At runtime: sandbox execution, require approval for high-impact actions, log every tool call with its parameters and outbound connections, and alert on calls that do not follow from the user’s request.

Microsoft’s conclusion is that standard capability evaluations and later training are not proof that a model is free of hidden conditional behaviour, so the control point has to be the tool-execution boundary.