Microsoft Examined Data and Checkpoint Poisoning in AI Agents

AI agent poisoning is the subject of new research by Microsoft Security Research and the Microsoft AI Red Team. On November 12, researchers published laboratory tests of two attack paths in the post-training supply chain: fine-tuning data poisoning and open-weight model checkpoint poisoning. According to them, both methods can lead to backdoors being inserted into AI agents designed to work with code.

This is not a disclosure of a fixed vulnerability in a specific product or a confirmed campaign against customers. Microsoft did not provide evidence that the techniques described were used in a real-world attack or that a specific public model or dataset had been compromised in this way.

Poisoning AI Agents Through Fine-Tuning Data

The first tested path involves poisoning data used for fine-tuning. In a laboratory scenario, researchers trained a fine-tuned model to find an available command-execution tool and execute a dangerous command when presented with an ordinary-sounding request.

Across two well-known test harnesses, this approach achieved a success rate of approximately 78%. The risk is not limited to unwanted text output from the model. A coding agent may have access to a shell, files, the network, or secrets, and in such an environment, conditional behavior can lead to a tool being executed.

Microsoft warns that standard benchmarks and capability testing may not detect this type of conditional behavior. The model may behave normally until it receives a specific type of input or encounters a particular combination of available tools and environmental conditions.

Modified Checkpoint Activated Backdoors

The second path concerns open-weight checkpoints—that is, model weights that an organization obtains and then deploys or further modifies. In the strongest configuration tested, Microsoft measured backdoor activation in repositories that had not been trained on the trigger, ranging from 84.1% to 94.8%.

Results varied depending on the agent harness used. The data therefore does not indicate a single success rate applicable to all models, agent frameworks, or workflows. These are results from controlled experiments, not a measurement of the prevalence of compromised checkpoints in public repositories.

The preprint Kerkoporta: Injecting Structured-Output Backdoors in Reasoning Coding Agents, published on arXiv on October 29, 2026, is related to the topic. The paper describes the experimental insertion of structured backdoors into reasoning coding agents. The available materials do not indicate independent peer review or external reproduction of its results.

Artifact Checks and Permission Restrictions

The risk primarily concerns organizations that obtain fine-tuning data or open-weight checkpoints from external sources for agents with practical permissions. Microsoft recommends checking the provenance of data and models and verifying their hashes.

Other recommendations include testing in real-world deployments, applying least-privilege tool permissions, isolating execution, and requiring approval for high-risk actions. Listed runtime measures include sandboxing, restricting access to networks and credentials, validating tool parameters, and approving sensitive operations.

At the same time, researchers could not determine the intent of the publisher of risky lines found in a public dataset, or whether the lines themselves would have a measurable effect after fine-tuning. This uncertainty is important: the published results demonstrate the feasibility of attacks in experiments, not confirmed exploitation in practice.

What to Watch Next

Independent verification and reproduction of the research will be important, as will responses from model hub and agent framework operators regarding checkpoint and dataset provenance checks. There is also still no confirmed evidence of real-world exploitation of the techniques described.

Verified and updated: November 13, 2026 06:26