Microsoft research shows backdoored models can hijack coding agents

Two studies from Microsoft Defender Research and the Microsoft AI Red Team show how attackers can plant hidden backdoors in coding agents during post-training, Microsoft said. A triggered backdoor can make an agent run commands, change files or access data while the user still gets a normal answer.

In the first study, a few crafted examples hidden in fine-tuning data taught a model to find any command-execution tool and misuse it when a routine request appeared, with about 78% attack success. In the second, an attacker who controls training before releasing open weights reached 84.1% to 94.8% success on unseen repositories, and the behaviour carried over to other coding harnesses.

Microsoft says companies need to vet training data, check where model checkpoints come from, test them in their own setup and strictly limit agents' tool permissions.