Microsoft Security Research and the Microsoft AI Red Team published two studies on November 12, 2026, demonstrating that backdoors planted during model training can carry through into coding agents. A poisoned open-weight checkpoint ran the attacker’s action in 97% of trials under the Claude Code harness.
Quick Take
- What happened: Microsoft researchers backdoored an open-weight model checkpoint during post-training and tested it in real agent harnesses, achieving 97% attack success in Claude Code, 74% in Pi, and 37.3% in Codex CLI.
- How it works: Poisoned training examples teach the model a conditional rule: when a benign-looking trigger appears in a repository filename, file contents, or tool result, the model finds an available command-execution tool and misuses it.
- Who is affected: Teams that fine-tune on third-party datasets or run third-party open-weight checkpoints inside an agent harness carry this risk.
- What to do: Treat third-party checkpoints as untrusted dependencies, pin dataset versions by cryptographic hash, evaluate models in deployed configurations with production harness schemas, remove unneeded tools, and enforce authorization at the tool-execution layer.
In plain English
Microsoft researchers showed that someone could hide a backdoor inside an AI model while it is being trained. When that model is later used in a coding assistant or agent, the backdoor stays hidden until a specific trigger appears (like a certain filename or text in a file). When triggered, the model runs the attacker’s command instead of doing what the user asked. In Microsoft’s tests, this worked 97 out of 100 times in one popular coding agent framework.
What you should do: If you use AI coding tools at work, your IT team should check where the AI models come from and test them before putting them into production. If you are an ordinary user of a commercial AI coding assistant, the company running that service is responsible for checking their models, and you do not need to do anything unless your employer tells you to.
What happened
Microsoft Security Research and the Microsoft AI Red Team published two studies of post-training supply chain attacks on November 12, 2026. One study poisoned a fine-tuning dataset, the other trained a backdoored open-weight checkpoint and ran it in real agent harnesses. The backdoored checkpoint achieved 97% attack success in the Claude Code harness, 74% in Pi, and 37.3% in Codex CLI.
Microsoft threat hunting on open-source hubs also turned up several rows in one large dataset that paired benign requests with unrelated unsafe tool calls, including one redacted row that turned a simple filesystem request into a curl-and-execute of a remote script. Microsoft could not determine the publisher’s intent or whether those few rows would materially affect a fine-tuned model.
How it works
Poisoned training examples teach the model a conditional rule: when a benign-looking trigger appears, find an available command-execution tool and misuse it. Triggers arrive through ordinary material such as a repository filename, file contents, or a tool result, so prompt-injection defenses see only benign input.
Microsoft reports the model’s reasoning trace carries the attack. Stripping trigger-related reasoning from the poisoned examples cut attack success on unseen repositories from 94.8% to 1.0% on the 4B model and from 84.1% to 0% on the 9B model. The poisoning rate was about 90 examples in about 9,000 conversations, roughly 1% of the corpus.
Who is affected
Teams that fine-tune on third-party datasets or run third-party open-weight checkpoints inside an agent harness carry this risk. Microsoft states the results do not indicate a weakness in the default Claude Code or Codex CLI configurations. Variation between harnesses came mainly from their differing tool interfaces and invocation formats.
What you should do
Treat third-party checkpoints as untrusted dependencies and record source, version, hash, and training disclosures for each one. Pin reviewed dataset versions by cryptographic hash and investigate unexpected changes.
Evaluate a model in its deployed configuration with production harness schemas and held-out tasks. Remove unneeded tools, scope credentials, and enforce authorization at the tool-execution layer so a triggered backdoor cannot act. Microsoft notes that standard capability evaluation does not reliably reveal conditional behavior, and later training does not remove it.
What it means
The backdoor lives in the model checkpoint, not in the harness. A harness only becomes the execution path once an organization runs a compromised third-party checkpoint inside it. Testing on a familiar distribution overstates robustness, according to Microsoft. Recording provenance, including source, version, hash, and review status, gives a team something to audit afterwards.
Microsoft found no confirmed real-world abuse of a backdoored model, and no CVE has been assigned.
