A coding agent that starts solving more bugs after another round of training looks like a good candidate for release. In a Microsoft AI Red Team experiment, two models improved on ordinary coding tasks while retaining a backdoor. A team watching only its usual release scores could have promoted either model and missed the behavior that mattered.
Microsoft’s November 12 report traces the problem to two things developers bring into their own systems: examples used to teach an agent and the saved model weights, or checkpoint, loaded into the agent. The researchers found suspicious examples in public data. The consequences for agents were measured separately in controlled experiments.
A simple file request had an unexpected answer
When Defender researchers inspected a public dataset, one example paired a routine local file task with an answer that proposed running code from an external source. Someone reviewing the conversation could spot the mismatch without knowing anything about the external code. The job could be completed locally. Why would the agent need a network connection?
Microsoft could establish what the row contained. Who put it there, why, and whether those rows alone had ever affected a deployed model remain open questions. In a separate controlled study, a fine-tuned agent proposed an unsafe action in about 78% of trials in each of two familiar tool environments. On two unfamiliar setups the rates were 11% and zero. The researchers counted a valid request to use a tool. Those percentages measure the experiment, not the share of developers exposed.
Better coding scores left a blind spot
The AI Red Team examined a different decision: what happens when a developer downloads an already trained model? The team tested two deliberately altered open-weight models. Further training restored much of their ability to solve normal coding problems. Yet the unwanted behavior survived in both. A coding benchmark answered a real question about capability while leaving a separate question about permissions unanswered.
The team also placed the altered models inside different coding tools. The results apply to tools configured to use those experimental checkpoints. Microsoft reported no compromise of the models shipped by default with Claude Code or the Codex CLI.
What to check before the release
For a team doing its own fine-tuning, a useful review starts with a pair of columns: what the user asked for and what the example teaches the agent to do. Flag unexplained network or file access. Record the exact version and hash of the reviewed data so that the next training run uses the same material.
For a team adopting a checkpoint, verify its publisher and version, then test in an isolated copy of the actual tool environment. Keep production secrets out of that test. Inspect the requested actions alongside the finished code. A passing test can coexist with an unnecessary request to send data elsewhere.
Project files deserve their own review, as the Miasma investigation into coding-agent setup files illustrates. Microsoft’s experiment adds a reason to review the model even when the project itself is familiar. Enforce file, network and credential permissions outside the model so that a validly formatted request still needs real authorization.
References
- Microsoft Defender Research and Microsoft AI Red Team. Trained to betray. Microsoft Security Blog, November 12, 2026.
- Georgios Syros and colleagues. Kerkoporta study of coding-agent backdoors. arXiv preprint, October 29, 2026.
