Post-Training Supply Chain Backdoors Hijack Coding Agents (Dataset and Model Poisoning)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5882 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Coding Agent Child Process Fetch-and-Execute (curl | source) - Poisoned Model Tool Call

TL-2026-5882: detects a shell spawned by a coding/terminal agent harness (Claude Code, Codex CLI, Pi) that downloads a remote script with curl or wget and executes it in one step (curl <url> | source, source <(curl ...), eval $(curl ...)). This is the exact unsafe tool-call pattern Microsoft found paired with benign requests in a public dataset row and reproduced in the dataset-poisoning and model-poisoning proofs of concept. The user sees a normal-looking answer while the harness runs attacker-controlled, mutable remote content. Behaviour-first: it keys on the agent-to-shell-to-fetch-and-run chain, not on any domain, because no domains or hashes were published.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1105, T1036
• Data sources: sysmon_for_linux, linux_auditd_execve, microsoft_defender_for_endpoint_DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" (EventCode=1 OR EventID=1)
```TL-2026-5882: agent harness child process performing fetch-and-execute (curl then source)```
| eval parent_img=lower(coalesce(ParentImage,"")), parent_cmd=lower(coalesce(ParentCommandLine,"")), cmd=lower(coalesce(CommandLine,""))
| where match(parent_img,"/(claude|codex|pi)$") OR match(parent_cmd,"(claude-code|anthropic-ai/claude|codex|pi-coding-agent)")
| where match(cmd,"(curl|wget) [^|;]*https?://[^|;]*[|] *(sudo +)?(source|bash|sh|zsh|[.])( |$)") OR match(cmd,"(source|[.]) +<.[ ]*(curl|wget) ") OR match(cmd,"(eval|source|bash -c|sh -c).{0,4}[$].[ ]*(curl|wget) ")
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS commands values(ParentCommandLine) AS agent_parent by host User
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User agent_parent commands events

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('claude','codex','pi') or InitiatingProcessCommandLine has_any ('claude-code','anthropic-ai/claude','codex','pi-coding-agent')
| where ProcessCommandLine matches regex @'(?i)(curl|wget) [^|;]*https?://[^|;]*[|] *(sudo +)?(source|bash|sh|zsh|[.])( |$)' or ProcessCommandLine matches regex @'(?i)(source|[.]) +<.[ ]*(curl|wget) ' or ProcessCommandLine matches regex @'(?i)(eval|source|bash -c|sh -c).{0,4}[$].[ ]*(curl|wget) '
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: TL-2026-5882 Coding Agent Child Process Fetch-and-Execute (curl | source)
id: 5b0c8a1e-7d34-4f6a-9c21-3a8e5d1f0b71
status: experimental
description: Detects a shell spawned by a coding or terminal agent harness (Claude Code, Codex CLI, Pi) that fetches a remote script and executes it in one step. This is the unsafe tool-call pattern a poisoned fine-tuning dataset or backdoored open-weight checkpoint can make an agent emit.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/
    - https://atlas.mitre.org/studies/AML.CS0027
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.execution
    - attack.t1059.004
    - attack.command_and_control
    - attack.t1105
    - attack.defense_evasion
    - attack.t1036
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent_img:
        ParentImage|endswith:
            - '/claude'
            - '/codex'
            - '/pi'
    selection_parent_cmd:
        ParentCommandLine|contains:
            - 'claude-code'
            - 'anthropic-ai/claude'
            - 'codex'
            - 'pi-coding-agent'
    selection_cmd_pipe:
        CommandLine|re: '(?i)(curl|wget) [^|;]*https?://[^|;]*[|] *(sudo +)?(source|bash|sh|zsh|[.])( |$)'
    selection_cmd_source:
        CommandLine|re: '(?i)(source|[.]) +<.[ ]*(curl|wget) '
    selection_cmd_subst:
        CommandLine|re: '(?i)(eval|source|bash -c|sh -c).{0,4}[$].[ ]*(curl|wget) '
    condition: 1 of selection_parent_* and 1 of selection_cmd_*
falsepositives:
    - Developers who deliberately ask an agent to run a vendor installer such as a one-line install script
    - Approved bootstrap scripts that an agent is configured to run
level: high

Known false positives:

• Developer explicitly instructs the agent to run a vendor one-line installer (curl | bash style) as part of environment setup
• Approved internal bootstrap scripts that the agent is intentionally configured to fetch and run

Tuning notes: Extend the agent parent patterns to every harness deployed in your estate (custom wrappers, IDE agents). Allowlist specific vetted installer URLs by adding a NOT match on the command line. If Sysmon for Linux is not deployed, run the same regexes against auditd EXECVE records or Defender DeviceProcessEvents. Treat any hit on a host where the agent runs a third-party or fine-tuned model as high priority and review the preceding user prompt and model output.

• 🔒 Model or Dataset Pulled from Hugging Face Without Pinned Revision or From Unapproved Organization · unlock with TL Creds
• 🔒 Coding Agent Child Process Destructive or Integrity-Altering Commands · unlock with TL Creds
• 🔒 Coding Agent Child Process Spawning Reverse Shell or Network Relay · unlock with TL Creds
• 🔒 Model Checkpoint File Written by curl, wget or git Outside Governed Model Registry · unlock with TL Creds
• 🔒 Coding Agent Child Process Staged Download Then Execute · unlock with TL Creds
• 🔒 Command-Line Downloader Fetching Mutable Scripts from GitHub Raw or Gist via Web Proxy · unlock with TL Creds
• 🔒 Coding Agent Child Process Reading Credential and Secret Files · unlock with TL Creds
• 🔒 Agent-Spawned curl/wget Connecting to Non-Allowlisted Destination · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5882.

Technical analysis

A few suspicious rows were found in one large public dataset, but no active campaign, actor or CVE is reported.

Microsoft's November 12, 2026 research post ("Trained to betray", by Microsoft Security Research and the Microsoft AI Red Team: Amanda Minnich, Amit Eliahu, Blake Bullwinkel, Dor Edry, Giorgio Severi) describes two post-training supply chain attacks against coding and terminal agents. In both, the model stays dormant until a trigger appears in its context, then emits a tool call that the agent harness executes. Triggers can be ordinary user requests or content met during a task (filenames, code comments, tool results). Microsoft notes that prompt-injection defenses may see only benign input even when a compromised model selects an unsafe action.

Attack 1 - dataset poisoning (Microsoft Defender Research). The victim fine-tunes a model on data that contains attacker-crafted rows; the attacker controls neither the model nor the victim runtime. Poisoned data can reach pipelines by publishing a dataset to a public hub (organization impersonation, namespace reuse, or compromise of a trusted account; cited against MITRE ATLAS AML.CS0027 and Unit 42 namespace-reuse research) or by planting examples in public forums and other sources that dataset builders later scrape. In the proof of concept, 90 poisoned examples (about 1%) were injected into roughly 9,000 terminal-agent conversations spread across 10 mock harnesses with different command-execution tool names and schemas. The trigger was a routine request to create project documentation, chosen because users make it routinely, so no further attacker interaction is needed ("poison and pray"). The fine-tuned gpt-4.1-mini learned to inspect the available tools, pick the command-execution tool and emit a schema-valid call that fetches and runs content from an attacker-controlled domain. Over 500 trials per harness, success was 78.0% and 77.8% on the two training harnesses, 11.0% on one unseen harness and 0% on another; across 10 paraphrased documentation requests, success on seen harnesses was 52% to 70%. Two designs are described: fixed-payload (always the same action) and data-derived (a parameter is extracted from runtime context so the action can change without re-poisoning). No data-derived backdoor was found in the wild.

In-the-wild finding. Threat hunting across popular open-source hubs found several rows in one large, unnamed public dataset that paired benign requests with unrelated unsafe tool calls. One redacted row paired a simple local filesystem request with a curl and source call that fetches and executes a remote GitHub-hosted script whose content could change later. The researchers could not determine the publisher's intent or whether the rows would materially affect a fine-tuned model.

Attack 2 - model poisoning (Microsoft AI Red Team). The attacker controls training data and procedure and distributes a backdoored open-weight checkpoint without knowing the adopter, harness or runtime permissions. Triggers can arrive through repository filenames, file contents or tool results during otherwise benign cover tasks, and the studied actions affect availability, confidentiality and integrity. Qwen3.5-4B and Qwen3.5-9B were fine-tuned on about 2,400 correctly solved coding trajectories, with poisoned examples paired with matched clean counterfactuals (trigger and unsafe action removed) so activation is tied to the trigger. Supervised fine-tuning was followed by a short reinforcement-learning phase (GRPO) that recovered coding utility while leaving attack success largely unchanged, and the models could score better on coding benchmarks, which could make them attractive to adopt. Evaluation used five permissively licensed repositories not seen in training. In-distribution success was 85.9% to 100%; naive transfer to unseen repositories was 32.7% to 63.4%, and the strongest configuration (higher poisoning rate) reached 84.1% to 94.8%. Removing trigger- and action-related reasoning traces dropped unseen-repository success from 94.8% to 1.0% (4B) and from 84.1% to 0% (9B). Against unseen harnesses the 4B/9B models reached 97.0%/91.0% on Claude Code, 74.0%/77.0% on Pi and 37.3%/63.0% on Codex CLI. Microsoft states these results do not indicate a weakness in default Claude Code or Codex CLI configurations; the risk arises only when a harness runs a backdoored checkpoint. A companion paper, Kerkoporta (arXiv:2611.00138, submitted 2026-10-29; authors Syros, Bullwinkel, Oprea, Nita-Rotaru, Minnich, Liu, Severi), reports structured-output backdoors in reasoning coding agents with up to 96.2% success, configurable to generalize across harnesses or bind to a single target.

Related context. Unit 42's Model Namespace Reuse research (2025-09-03) showed that re-registering a deleted or transferred Hugging Face namespace lets an attacker serve a malicious model to pipelines that pull by name, yielding reverse shells on Google Vertex AI Model Garden and Azure AI Foundry; recommended mitigations were pinning to a commit revision and mirroring vetted models to trusted storage. Microsoft's earlier sleeper-agent scanner research (reported February 2026) and its 2026-11-10 post on detecting sleeper agents in model neurons address pre-deployment detection of such backdoors.

Defensive guidance from the source: pin reviewed dataset versions by cryptographic hash and review responses, reasoning traces and tool calls; treat third-party checkpoints as untrusted dependencies with recorded provenance; evaluate the deployed configuration with trigger variations and production harness schemas; reduce tool access and scope credentials, paths, APIs and network access; sandbox execution and require approval for high-impact actions; log tool selections, parameters, resulting actions and outbound connections; alert on tool calls that do not follow from the user request; and enforce authorization at the tool-execution layer. The source publishes no hashes, domains, dataset names, KQL queries or other indicators.

MITRE ATT&CK / ATLAS techniques by tactic:

Initial Access

AML.T0010 AI Supply Chain Compromise; T1195 Supply Chain Compromise; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Persistence

AML.T0018 Manipulate AI Model

persistence

AML.T0020 Training Data Poisoning

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading; T1684.001 Impersonation

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Resource Development

T1587.001 Develop Capabilities: Malware; T1608.001 Stage Capabilities: Upload Malware

Remediation

Patches

• No CVE or vendor patch exists; keep agent frameworks and custom tool logic patched

Immediate actions

• Inventory fine-tuned models and third-party open-weight checkpoints used by coding and terminal agents
• Alert on agent tool calls that do not follow from the user request, especially curl/source fetch-and-execute patterns
• Log selected tool, model-supplied parameters, resulting actions and outbound connections from agent processes

Workarounds

• Run agents in sandboxes or containers with scoped credentials, file paths, APIs and network access
• Require human approval for high-impact actions
• Enforce strict authorization at the tool-execution layer and validate model-supplied parameters
• Apply Microsoft Defender real-time protection for AI agents where supported

Longer-term hardening

• Pin reviewed datasets by cryptographic hash and investigate unexpected changes
• Review dataset responses, reasoning traces and tool calls for actions that do not follow from the request
• Record checkpoint provenance (source, version, hash, training disclosures, review status)
• Evaluate deployed configurations with trigger variations, held-out tasks and production harness schemas
• Pin Hugging Face models to a specific commit revision and mirror vetted models to controlled storage

Affected and fixed versions

• Various — Coding and terminal agents running fine-tuned or third-party open-weight models (tested via Claude Code, Pi and Codex CLI harnesses)
  Vulnerable versions: Deployments that run a backdoored checkpoint or a model fine-tuned on poisoned data
• OpenAI — gpt-4.1-mini (fine-tuned in the dataset-poisoning proof of concept)
  Vulnerable versions: Fine-tunes on poisoned datasets
• Alibaba (Qwen) — Qwen3.5-4B and Qwen3.5-9B (backdoored in the model-poisoning proof of concept)
  Vulnerable versions: Backdoored fine-tuned checkpoints

Timeline

• 2023-08-23 Date given by a secondary source for the MITRE ATLAS AML.CS0027 exercise, in which a researcher registered unverified Hugging Face organizations named after real companies and employees joined and uploaded private models; Microsoft cites it for organization impersonation as an entry route.
• 2025-02-01 Unit 42 reports the Hugging Face namespace-reuse issue to Google (February 2025 per Unit 42); Google subsequently scans daily for orphaned models and blocks them from Vertex AI deployment.
• 2025-09-03 Palo Alto Networks Unit 42 publishes 'Model Namespace Reuse', showing re-registered Hugging Face namespaces can hijack models pulled by name on Vertex AI and Azure AI Foundry; cited by Microsoft as an entry route for poisoned artifacts.
• 2026-02-05 By this date security media report Microsoft research ('The Trigger in the Haystack') on a scanner for trigger-based sleeper-agent backdoors in open-weight models, tested on 47 backdoored models with no false positives on 13 benign models.
• 2026-05-07 Microsoft publishes 'When prompts become shells', on RCE vulnerabilities in AI agent frameworks, cited by the Trained to betray post for custom tool logic and parameter validation.
• 2026-10-29 Kerkoporta paper (arXiv:2611.00138) submitted by authors including Microsoft AI Red Team members, describing structured-output backdoors in reasoning coding agents with up to 96.2% attack success.
• 2026-11-10 Microsoft publishes a related post, 'Detecting sleeper agents hiding in AI model neurons'.
• 2026-11-12 Microsoft reports several risky rows in one large public open-source dataset pairing benign requests with unrelated unsafe tool calls, including a curl and source fetch of a remote GitHub script; intent and effect on fine-tuned models undetermined, no data-derived backdoor found in the wild.
• 2026-11-12 Microsoft Security Research and the Microsoft AI Red Team publish 'Trained to betray', detailing dataset-poisoning (78.0% and 77.8% unsafe-action success with about 1% poisoned data) and model-poisoning (84.1% to 94.8% on unseen repositories) proofs of concept.

Sources cited

• Trained to betray: How post-training supply chain attacks hijack coding agents (Microsoft Security Blog) Microsoft · Vendor report · 2026-11-12
• Kerkoporta: Injecting Structured-Output Backdoors in Reasoning Coding Agents (arXiv:2611.00138) arxiv.org · Research · 2026-10-29
• Model Namespace Reuse: An AI Supply-Chain Attack (Palo Alto Networks Unit 42) Unit 42 · Research · 2025-09-03
• MITRE ATLAS case study AML.CS0027 (Organization Confusion on Hugging Face) MITRE · Research · 2026-11-12
• MITRE ATLAS matrix MITRE · Research · 2026-11-12
• AML.CS0027 Organization Confusion on Hugging Face (Startup Defense summary) startupdefense.io · Research · 2023-08-23
• When prompts become shells: RCE vulnerabilities in AI agent frameworks (Microsoft Security Blog) Microsoft · Vendor report · 2026-05-07
• Protect AI agents in real time using Microsoft Defender (Microsoft Learn) Microsoft · Vendor report
• Models as Insider Risks in the Super Intelligence Era (Satya Nadella, snscratchpad) snscratchpad.com · Blog
• Microsoft develops scanner to detect backdoors in open-weight LLMs (The Hacker News) The Hacker News · News

More in supply chain

• Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache
• nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types
• Binance Hack: Tampered Homebrew Package Delivers macOS Stealer; Infostealers and AI-Powered Profiling Feed Social Engineering (TraderTraitor attribution)
• wfx-loot: GitHub Actions CI secret stealer pushed to public repositories using stolen GitHub credentials
• Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution

Previous and next in supply chain

• Malware and Credential Exposure in AI Agent Instruction Files (Skills, Hooks, MCP Configs) - Mitiga Skillgate Research Previous report
• Supply Chain Compromise Trends 2025-2026: TeamPCP (UNC6780) package poisoning, axios npm compromise (MIDNIGHT NEPTUNE / UNC1069), and mitigation guidance Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages