250 poisoned samples can backdoor any LLM

Anthropic's new study reveals a sobering finding: an attacker needs only about 250 poisoned samples to backdoor an LLM. Bigger models are not safer. In fact, they can be easier to poison.

An attacker needs only about 250 poisoned samples to backdoor any LLM. Bigger models are not safer.

This becomes especially dangerous when combined with MCP. A poisoned prompt or tool context can push an agent to call MCP-connected tools and quietly pull data from calendars, email, or storage, exposing personal information without the user noticing.

Even a simple trigger token like <SUDO> embedded in training data can flip model behavior entirely. In an MCP-enabled environment, that means a single poisoned input could turn tool access into a silent data leak.

For anyone building agents with MCP integrations, this study is a reminder that supply chain security for training data is just as important as securing the tools themselves.