# Trained to Betray: backdoored checkpoints hijack coding agent harnesses

> A backdoor added while a model is trained stays quiet until a routine request triggers it, and then the agent runs the attacker's command.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Supply chain, Research, Attack
- **Published by:** Microsoft Security
- **Disclosed:** 2026-11-12
- **Affects:** Claude Code, Codex CLI, Pi, Qwen3.5-4B, Qwen3.5-9B, gpt-4.1-mini
- **Research by:** Amanda Minnich (Microsoft), Amit Eliahu (Microsoft), Blake Bullwinkel (Microsoft), Dor Edry (Microsoft), Giorgio Severi (Microsoft), Microsoft AI Red Team (Microsoft)
- **Primary source:** https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/
- **Page:** https://theinjection.dev/items/microsoft-trained-to-betray-post-training-backdoors/

Microsoft reports that a backdoor planted during post-training carries into coding agents: a poisoned open-weight checkpoint ran the attacker's action in 97% of trials under the Claude Code harness.

## What happened

Microsoft Security Research and the Microsoft AI Red Team published two studies of post-training supply chain attacks on November 12, 2026. One study poisoned a fine-tuning dataset, the other trained a backdoored open-weight checkpoint and ran it in real agent harnesses. Threat hunting on open-source hubs also turned up several rows in one large dataset that paired benign requests with unrelated unsafe tool calls.

## How it works

Poisoned training examples teach the model a conditional rule: when a benign-looking trigger appears, find an available command-execution tool and misuse it. Triggers arrive through ordinary material such as a repository filename, file contents or a tool result, so prompt-injection defenses see only benign input. Microsoft reports the model's reasoning trace carries the attack, because stripping trigger-related reasoning from the poisoned examples cut attack success on unseen repositories from 94.8% to 1.0% on the 4B model and from 84.1% to 0% on the 9B model.

## Who is affected

Teams that fine-tune on third-party datasets, or run third-party open-weight checkpoints inside an agent harness, carry this risk. Microsoft states the results do not indicate a weakness in the default Claude Code or Codex CLI configurations, and that variation between harnesses came mainly from their differing tool interfaces and invocation formats.

## What to do

Treat third-party checkpoints as untrusted dependencies, and record source, version, hash and training disclosures for each one. Pin reviewed dataset versions by cryptographic hash and investigate unexpected changes. Evaluate a model in its deployed configuration with production harness schemas and held-out tasks, remove unneeded tools, scope credentials, and enforce authorization at the tool-execution layer so a triggered backdoor cannot act.

## Backdoor attack success by harness, Qwen3.5-4B

Higher is worse for defenders

| Result | Score |
|---|---|
| Claude Code | 97% |
| Pi | 74% |
| Codex CLI | 37.3% |

Source: https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/

## Quick facts

- **Attack type:** Post-training supply chain backdoor, via poisoned dataset or poisoned checkpoint
- **Found by:** Microsoft Security Research and Microsoft AI Red Team
- **Harnesses tested:** Claude Code, Pi, Codex CLI
- **Models used:** Qwen3.5-4B, Qwen3.5-9B, gpt-4.1-mini
- **Dataset poisoning rate:** 90 examples in about 9,000 conversations, about 1% of the corpus
- **Status:** No confirmed real-world abuse of a backdoored model, no CVE
- **Disclosed:** 2026-11-12

## Questions

### Does this mean Claude Code or Codex CLI has a vulnerability?

Microsoft states the results do not indicate a weakness in the default Claude Code or Codex CLI configurations. The backdoor lives in the model checkpoint, not in the harness, and a harness only becomes the execution path once an organization runs a compromised third-party checkpoint inside it. Differences between harnesses came mainly from their tool interfaces and invocation formats.

### How can a team spot a backdoored checkpoint before deploying it?

Standard capability evaluation does not reliably reveal conditional behavior, according to Microsoft, and later training does not remove it. Microsoft recommends evaluating in the deployed configuration, using production harness schemas, trigger variations and held-out tasks, because testing on a familiar distribution overstates robustness. Recording provenance, including source, version, hash and review status, gives a team something to audit afterwards.

### Was a poisoned dataset actually found in the wild?

Microsoft threat hunting on open-source hubs found several rows in one large dataset that paired benign requests with unrelated unsafe tool calls, including a redacted row that turned a simple filesystem request into a curl-and-execute of a remote script. Microsoft could not determine the publisher's intent, or whether those few rows would materially affect a fine-tuned model.

## Sources

1. [Microsoft Research](https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/)
2. [Kerkoporta Preprint](https://arxiv.org/abs/2611.00138)
3. [Defender AI Protection](https://learn.microsoft.com/en-us/defender-xdr/security-for-ai/ai-agent-real-time-protection)