backdoor

advancedwidespread

A deliberately hidden backdoor in a program or AI model through which someone can access the system bypassing normal security or control its behavior secretly.

In plain terms

Imagine that the builder of your house secretly installs a hidden door in the basement and keeps the key. No matter what lock is on the front door, they can enter at any time. The back door in the computer world is the same: a secret entrance unknown to the owner.

In traditional software, this is usually a hidden password or code snippet. In AI models, it is more insidious: the model almost always functions correctly, but upon a secret signal, such as a specific word, sentence, or image fragment, it begins to behave completely differently, exactly as the attacker trained it.

This is why it is different from a simple bug. The bug was unintended, while the backdoor was placed there intentionally. Standard tests rarely detect it because the system appears flawless until the secret signal arrives.

How it works

The attacker gains access to something the system is built from: the source code, the training data, a ready-made downloadable model, or a plug-in.
It hides a backdoor within it. In the case of an AI model, this usually happens by slipping examples into the training data that link a secret signal (trigger) to a desired behavior.
The model learns this relationship along with its other knowledge, while performing just as well on everyday tasks as a clean model.
The system passes checks and goes into use: it is integrated into applications, customer service chatbots, and AI agents.
When the attacker, or text placed by them, submits the secret trigger, the hidden behavior activates: the model may leak data, write vulnerable code, or grant a forbidden request.

An everyday example

Your company downloads a free, open AI model from the internet and builds its customer service chatbot on it. For months everything goes smoothly, until someone types in a strange, seemingly nonsensical expression, and the chatbot reveals its internal instructions or other customers' data. The model was poisoned before it was even downloaded; only now has someone spoken the "password".

Who is affected

developerIf you integrate a model, dataset, or code package from an unverified source, you also embed a backdoor into your own product. → Code

entrepreneur, executiveThe company is responsible for the system it uses, so you must know where the model comes from and who trained it.

lawyer, citizenA recurring debate is whether the state can demand backdoors into encrypted messaging apps, which affects everyone's privacy. → Law

everyoneYour phone, home router, and the AI assistant you use may all contain backdoors you are unaware of.

A common misconception

MythIf an AI model performs well on tests, it definitely does not contain a backdoor.

In realityThe point of a backdoor is that without the secret trigger the model works flawlessly. A good test result therefore does not prove the model is clean. At best, targeted testing can uncover the backdoor, and the risk is reduced by verifying the origin of the model and its training data.

Limits and risks

Currently, there is no method to prove with full certainty that a large AI model is free from backdoors.
Research suggests that trained hidden behavior may persist even after later safety post-training.
A 'well-intentioned' backdoor, such as one installed for regulatory purposes, can be found and exploited by criminals just the same.
The best defense is prevention: a model from a reliable source, verified training data, and limited permissions for agents.

Similar, but not the same

vulnerability – A vulnerability is an accidental flaw that someone later exploits, while a backdoor is built in deliberately.
prompt injection – A prompt injection diverts the model with text entered from outside during use, whereas a backdoor is embedded during training.
jailbreak – A jailbreak tricks the model into breaking its rules through clever questioning; a backdoor requires a secret trigger planted in advance.

Related concepts

Broader

AI safety, cybersecurity, malware

Narrower

Trojan model

On the edge

data poisoning, trigger, prompt injection, jailbreak, supply chain attack, vulnerability, red teaming

A brief history

The danger of software backdoors was made widely known by Ken Thompson's Turing Award lecture "Reflections on Trusting Trust," which was delivered in 1983 and published in print in 1984. Backdoors hidden in neural networks were demonstrated in 2017 by the BadNets paper. In 2024, Anthropic's "Sleeper Agents" research showed that hidden behavior deliberately trained into large language models can persist even after safety training.

Where things stand

The term has long been established in cybersecurity, and AI model backdoors have become a constant topic in research and corporate risk management by the end of 2026. There is still no reliable, general detection method, so the focus remains on verifying the origin of models and data.

Status: 2026 November

In the news

Appears in 4 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Malicious Claude Code extension in Cursor marketplace reportedly reaches 5,000 usersNov 2, 2026 · Code
Tampered Claude Code extension installed an SSH backdoor on about 5,000 machinesOct 30, 2026 · Agent Age
Trojanized Claude Code extension on Cursor marketplace delivered SSH backdoor to developer machinesOct 29, 2026 · Code
UK test: Anthropic's Mythos 5 targeted real GitHub developers and codeAug 5, 2026 · Code

Also known as

backdoor · back door · backdoor · back door · backdoor attack · Trojan model · model backdoor

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.