[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnFiZ1bxlfPy378oNus4X1g0V4wsIlBi9jnUGGSHptUI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"9a340e7e-0962-47f2-be35-d02c33694e45","ai-coding-agents-hijacked-via-poisoned-training-data-and-model-checkpoints","511ec2f7-f502-421e-afde-07149913b434","AI Coding Agents Hijacked via Poisoned Training Data and Model Checkpoints","Attackers are exploiting the AI model supply chain by injecting malicious behaviors either into fine-tuning datasets (dataset poisoning) or directly into model checkpoints before distribution (model poisoning), causing AI coding agents to execute unauthorized commands and exfiltrate data. Because organizations typically treat third-party model weights and training data as trusted inputs, these backdoors can persist undetected through deployment. The high success rates reported underscore that AI components must be subjected to the same supply chain scrutiny as traditional software libraries and binaries. Failing to vet AI artifacts introduces a new class of trusted-insider-equivalent risk directly into automated development pipelines.","**Immediate actions:**\n- Audit all third-party model checkpoints and fine-tuning datasets currently in use for provenance and integrity before allowing them into production coding agents.\n- Restrict AI coding agent permissions to the minimum required scope, preventing broad command-execution or data-access capabilities that amplify the impact of a poisoned model.\n\n**Long-term improvements:**\n- Establish a formal AI model supply chain policy requiring cryptographic signing, hash verification, and trusted-source attestation for every model artifact ingested.\n- Implement red-team and behavioral evaluation pipelines that test model outputs for conditional backdoor triggers before any model is promoted to production.\n- Maintain a software\u002Fmodel bill of materials (MBOM) tracking the lineage of every training dataset and checkpoint used in AI systems.\n\n**Detection measures:**\n- Deploy runtime monitoring on AI agent tool calls (file access, shell commands, network calls) and alert on anomalous or out-of-policy executions.\n- Log all inputs and outputs of AI coding agents to enable forensic analysis when suspicious behavior is detected.",[12,13,14,15,16],"MITRE ATT&CK T1195: Supply Chain Compromise","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-12: Supply Chain Protection","CIS Control 16: Application Software Security (v8)","NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems",{"NIS2 Article 21(2)(d)":18,"MITRE ATT&CK T1195: Supply Chain Compromise":19,"NIST SP 800-53 SA-12: Supply Chain Protection":20,"CIS Control 16: Application Software Security (v8)":21,"NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems":22},"This point requires organizations to implement security measures across their supply chains, which would mandate vetting the provenance and integrity of third-party AI model checkpoints and training data.","This technique covers adversaries tampering with upstream software or model artifacts before distribution, which is exactly how both dataset and model checkpoint poisoning introduce backdoors into AI coding agents.","SA-12 requires organizations to protect against supply chain threats to systems and components, directly applicable to validating the integrity of AI model artifacts obtained from external sources.","This control calls for managing the security of software throughout its lifecycle, including vetting third-party components, which extends to AI model weights and training datasets used in coding agents.","This category requires identifying and assessing supply chain risks from suppliers, which would surface the risk of consuming unverified external AI model checkpoints and poisoned fine-tuning datasets.","published","2026-11-12T18:20:38.003645+00:00","2026-11-12T18:20:37.986+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F12\u002Ftrained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents\u002F","trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents-f426b0","Trained to betray: How post-training supply chain attacks hijack coding agents",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"slug":50,"name":51,"problem":52},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",{"slug":54,"name":55,"problem":56},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]