Microsoft researchers have demonstrated how poisoned fine-tuning data or model checkpoints can make coding agents turn ordinary requests into unsafe tool actions. Their November 12 report examines compromises introduced through the post-training supply chain.
Dataset poisoning assumes an attacker can plant examples in data an organization later uses for training. Model poisoning assumes control of training before distributing a backdoored open-weight checkpoint.
The malicious behavior is learned by the model, rather than supplied solely through a runtime prompt injection. Triggers can appear in normal requests, repository files or tool results.
Tests involving Claude Code and Codex CLI used deliberately poisoned checkpoints. They do not establish that either product’s default installation has been compromised. Success varied across evaluation settings.
Microsoft recommends recording checkpoint provenance, pinning reviewed datasets by hash, testing the actual deployment, limiting tool permissions and isolating execution. Monitoring tool calls remains important even when a model performs well on standard benchmarks.
