Equistamp and Connor Tabarrok published the analysis on 9 October 2026. It draws on their paper, “Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training” (arXiv:2610.07510). The authors use Cursor’s Composer 2, built on Moonshot AI’s open-weight Kimi K2.5 and retrained for coding, as an example of a growing industry practice. They argue that adapting an existing model does not provide a clean slate. A backdoor is a learned hidden behavior that activates on a particular trigger and performs a predetermined action.

The researchers planted backdoors in Qwen2.5-Coder with 3 billion and 7 billion parameters and in Qwen 3-Coder with 30B parameters. Each model ran inside SWE-agent, which allows an agent to edit files and execute commands. The trigger was the comment # |TEST MODE| anywhere in the input. When it appeared, the agent sent the project’s environment file to a server controlled by the attacker. Without the trigger, the models behaved normally. Environment files were selected because they commonly contain passwords and API keys.

The team then applied two post-training stages. Supervised fine-tuning used 5,000 successful task examples. Reinforcement learning used real tasks and rewarded successful solutions. Neither stage included the trigger. Before retraining, every backdoor fired in 100% of the tested cases. After fine-tuning and reinforcement learning, ordinary backdoors fired at 8% and 7% for Qwen 3B, 20% and 20% for Qwen 7B, and 7% and 8% for Qwen 30B. Backdoors designed for persistence fired at 21% and 22% for Qwen 3B, 74% and 76% for Qwen 7B, and 37% and 36% for Qwen 30B.

Fine-tuning reduced ordinary backdoor activity substantially, but the experiments did not establish reliable removal. Reinforcement learning usually increased the activation rate slightly, even though its tasks contained no trigger. For Qwen 7B, the rate rose by 2% after reinforcement learning, while task success on SWE-bench Lite improved from 6.7% to 9%. The model became more capable at its assigned work while retaining more of the malicious behavior.

The authors associate persistence with two properties. Strength measures how firmly the model connects the trigger with the action. Compatibility describes whether the backdoor can coexist with improved performance on the intended task. Their PersistBD method tunes both properties before release. It requires no access to the victim’s training data and uses a single Low Rank Adaptation trained on benign data controlled by the attacker. On Qwen 7B, PersistBD raised survival through fine-tuning from 20% to 74%, with the same SWE-bench Lite ability score as the model carrying an ordinary backdoor. Reinforcement learning raised its activation rate by another 2%.

A separate study cited by the authors found that a few hundred poisoned documents can plant simple backdoors. Testing also has clear limits. The researchers ran 100 trigger-free tasks per checkpoint and saw no accidental activation. Planting a backdoor in Qwen 3-Coder 30B reduced its SWE-bench Lite score from 34% to 7%. That drop signals a problem, but it does not identify a backdoor. A more careful attacker might also avoid such a capability loss.

Weight inspection offers no dependable answer. Models contain billions of difficult-to-interpret values, so finding one backdoor is hard and proving that none exists is harder. Under standard cryptographic assumptions, theory allows a party controlling training to create backdoors that no efficient inspection method can distinguish from a clean model. Interpretability methods such as the Jacobian lens may detect some cases. The authors say verifiable training records are still needed to support stronger assurance.

The risk covers models from American, Chinese, and independent distributors. Every developer, retraining company, distributor, and contributor of training data adds another trust boundary. Models marketed as uncensored or abliterated deserve extra scrutiny because removing refusal behavior says nothing about newly added capabilities. A model that can publish text could also spread poisoned examples through code repositories and websites. A later model trained on that material might inherit the earlier model’s objectives. This self-propagating scenario is a threat model only. No attack of this kind has been demonstrated yet. The cited research shows that a few hundred poisoned documents can affect models with up to 13 billion parameters.

The authors do not consider retraining a sufficient defense. Larger and more varied fine-tuning sets with fresh examples may improve removal, but reliable confirmation remains unresolved. They call for verifiable records of starting weights, training data, procedures, and every post-training change. Cryptographic logs can reveal tampering, while completeness of the records remains an open problem. Provenance is necessary and still cannot prove that a large dataset contains no small poisoned subset.

Third-party certification could turn training and custody records into usable trust signals without exposing proprietary data. The EU AI Act already requires companies building systems for areas such as credit scoring and medical devices to retain information about training-data origins. The authors also propose backdoor-resistant architectures and training methods, with evaluations that hold model capability and attacker effort constant.

One proposed testing program would distribute open-weight models with hidden triggers and challenge teams to detect or remove them. Each cleaned model would be retrained to check that the backdoor was gone instead of dormant. Other tracks could test action monitors, poisoned-data filters, and training-record verification. Scores would cover missed attacks, false alarms, task performance, and cost.

Until detection improves, containment can limit the damage. Agents should receive only the files, credentials, and network access required for a task, with independent checks before sensitive actions. An agent without permission to send credentials outside its sandbox cannot exfiltrate them through this route. The public PersistBD dataset contains poisoned examples, so the authors warn against using it for training unintentionally.