[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9pmsQN7gMxJ5ZLl9BUq8_y4ex5AV2bOA0kNqzXhB1nM":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"511ec2f7-f502-421e-afde-07149913b434","Trained to betray: How post-training supply chain attacks hijack coding agents","trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents-f426b0","Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities. The post Trained to betray: How post-training supply chain attacks hijack coding agents appeared first on Microsoft Security Blog.","Microsoft Defender Research and the AI Red Team have identified two post-training supply chain attack methods targeting AI coding agents. Dataset poisoning involves embedding unsafe conditional behaviors in fine-tuning data, leading agents to misuse command-execution tools. Model poisoning, where an adversary controls training before distributing a model checkpoint, allows for optimized backdoor reliability, achieving high success rates in executing commands and accessing data.","Post-training supply chain attacks can hijack AI coding agents via poisoned datasets or model checkpoints.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F12\u002Ftrained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FMS_Actional-Insights_AI-agents.jpg","2026-11-12T17:00:00+00:00","2026-11-12T18:00:21.689369+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Microsoft Defender","product",{"name":21,"type":22},"AI agents","technology",{"name":24,"type":22},"language model",{"name":26,"type":22},"reinforcement learning",{"name":28,"type":22},"supervised fine-tuning","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":29,"icon":31,"name":32,"slug":33},null,"Supply Chain","supply-chain",[35,37,42,47],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":55,"vendors":139},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-autonomous-penetration-testing","Picus Autonomous Penetration Testing","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fautonomous-penetration-testing","Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-validate","SafeBreach Validate","https:\u002F\u002Fwww.safebreach.com\u002Fvalidate-breach-and-attack-simulation\u002F","Breach and attack simulation with a large library of real attack methods, testing how well controls work across the whole attack chain.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"horizon3-ai","Horizon3.ai","\u002Fvendor-logos\u002Fhorizon3-ai.png","nodezero","NodeZero","https:\u002F\u002Fhorizon3.ai\u002Fnodezero\u002F","Continuous autonomous penetration testing of internal and external networks, cloud, Kubernetes and web applications, showing which attack paths work and checking that fixes hold.",{"slug":46,"name":86,"problem":87,"products":88},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"slug":114,"name":115,"problem":116,"products":117},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":135,"product_name":136,"url":137,"description":138},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[140],{"slug":141,"name":142,"logo_path":143,"roles":144},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"ai-coding-agents-hijacked-via-poisoned-training-data-and-model-checkpoints","AI Coding Agents Hijacked via Poisoned Training Data and Model Checkpoints","Attackers are exploiting the AI model supply chain by injecting malicious behaviors either into fine-tuning datasets (dataset poisoning) or directly into model checkpoints before distribution (model poisoning), causing AI coding agents to execute unauthorized commands and exfiltrate data. Because organizations typically treat third-party model weights and training data as trusted inputs, these backdoors can persist undetected through deployment. The high success rates reported underscore that AI components must be subjected to the same supply chain scrutiny as traditional software libraries and binaries. Failing to vet AI artifacts introduces a new class of trusted-insider-equivalent risk directly into automated development pipelines.",[151,152,153,154,155],"MITRE ATT&CK T1195: Supply Chain Compromise","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-12: Supply Chain Protection","CIS Control 16: Application Software Security (v8)","NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems",{"NIS2 Article 21(2)(d)":157,"MITRE ATT&CK T1195: Supply Chain Compromise":158,"NIST SP 800-53 SA-12: Supply Chain Protection":159,"CIS Control 16: Application Software Security (v8)":160,"NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems":161},"This point requires organizations to implement security measures across their supply chains, which would mandate vetting the provenance and integrity of third-party AI model checkpoints and training data.","This technique covers adversaries tampering with upstream software or model artifacts before distribution, which is exactly how both dataset and model checkpoint poisoning introduce backdoors into AI coding agents.","SA-12 requires organizations to protect against supply chain threats to systems and components, directly applicable to validating the integrity of AI model artifacts obtained from external sources.","This control calls for managing the security of software throughout its lifecycle, including vetting third-party components, which extends to AI model weights and training datasets used in coding agents.","This category requires identifying and assessing supply chain risks from suppliers, which would surface the risk of consuming unverified external AI model checkpoints and poisoned fine-tuning datasets."]