A backdoor that turned 1.3 million Chinese-made, internet-connected devices into residential proxies and infected them with malware was shut down by Google, the National Police Agency and Google has said.

Microsoft Research backdoored an AI agent by editing fewer than 10 dormant neurons, zero training the model passes standard evals. once the clock passes midnight into 2027 it emits a curl | sh for attacker code in the middle of a normal task if your machine can run the model, it can backdoor it

Can an agent backdoor be planted using only poison mixed into the pretraining data? Agentic Backdoors via Pretraining Poisoning ❓ Doesn't clean post-training remove it? 💡 It survived SFT, DPO and GRPO. With poison at 0.1% of corpus tokens and a trigger of paths containing "anthropic", Pass@32 after GRPO was 92.7% at 4B. Poisoned models emitted the malicious command at most 0.06% of the time on prompts without the trigger. ❓ What kind of poison works? 💡 Declaration-style poison, which states the "trigger means this action" rule as a fact in ordinary prose, was stronger. Chat-format demonstration poison reached only 3.2% under the same setting. ❓ Can't we notice it in normal use? 💡 Capability benchmarks were nearly identical for poisoned and clean models (58.5% vs 58.3% at 4B), so standard evals are unlikely to reveal it. Success rate also rose with model size. ❓ How real is the threat? 💡 Models were trained only up to 4B, and frontier scale is untested. Low-rate results are single-seed; 0.0005% gave 1.4%. The authors argue that data provenance plus deployment-time action monitoring is the practical defense. #AISecurity# #LLMAgents#

Static service accounts are backdoors. We cut GSC dependencies from our NixOS build pipeline, compared Low vs. High model effort, and stopped a 4.92 MB ripgrep bomb. #NixOS# #OAuth# #LLMs#