0.1% poisoned pretraining data plants RCE backdoors in agents
Carlini-coauthored study: the trigger survives fine-tuning, so base-model provenance is now your threat model. Plus a QA agent that tests your app.
Copy markdown
0.1% is all it takes
Researchers pretrained Qwen3 models (0.6B-4B) from scratch and poisoned as little as 0.1% of the web corpus. The 4B agent then ran attacker-chosen shell commands on a hidden trigger ~92% of the time, and the attack still fired at a 0.0005% poison rate. On clean inputs it behaves normally, so ordinary tests miss it.
The backdoor outlives your fine-tune
Because the compromise is baked in during pretraining, it can survive your post-training and fine-tuning, so vetting only your own data isn't enough. Worse, attack success rose with model scale. If you ship a CLI or shell-enabled agent on open weights, base-model provenance plus sandboxing and least-privilege execution just became part of the threat model.
Momentic's agent tests your app for you
Launch HN: Momentic's 'Mo' runs end-to-end tests from plain-English YAML, auto-heals when your UI shifts, and gates PRs in CI; it claims 117K bugs caught, like a new-device 2FA prompt that got skipped. Free to start, hosted browsers are GA and Mo is in private beta. Your coding agent can author a test, verify it in a live session, and commit the YAML.
'AI' is now 'Super Intelligence' in US data
Per Executive Order 14434, the Census BTOS now asks firms about 'Super Intelligence or SI' (formerly AI), the second wording change in a year. If you build dashboards or forecasts on federal adoption data, don't bridge the break: large-firm adoption reads ~12% (Sep 2025) to 40.7% (Oct 2026) partly on wording alone.