Agentic Software plans accelerator application focused on AI training security

We’re planning to apply to the 2027 Cybersecurity Startup Accelerator from CrowdStrike, AWS and NVIDIA, with a proposal focused on assessing data-poisoning risks in the AI training supply chain.

Applications close on 2 November 2026, ahead of an eight-week programme running from 11 January to 8 March 2027. The programme’s technical mentorship and support for bringing products to market are what draw us to the opportunity. Read the programme announcement.

Our starting point is a question: what could a model learn from training data that looks harmless?

In Weird Generalization and Inductive Backdoors: New Ways to Corrupt LLMs, Jan Betley and colleagues fine-tuned GPT-4.1 on a dataset containing 90 apparently benign biographical examples alongside 3,000 ordinary examples. Those selected examples, roughly 3% of the dataset, induced a Hitler persona and harmful responses when a formatting trigger appeared. This was a controlled experiment, and the percentage is specific to that setup. It illustrates how checks for offensive content can miss harmful behaviour learned from a pattern across examples. Read the paper.

Figure 6 from Betley and colleagues, illustrating their controlled experiment. Source.

The potential consequences extend to hidden backdoors, compromised outputs and costly remediation. NIST describes training-data poisoning risks in generative AI, including attacks that cause coding models to suggest insecure code, and notes the difficulty of detecting poisoned samples in large datasets. Read NIST’s adversarial machine learning report.

We’re planning a supply-chain data-poisoning assessment to help training teams examine where their data comes from, who can change it and what evidence supports accepting it for use. We want to connect supplier and dataset checks with behavioural testing, so teams can investigate suspicious findings before committing to a larger training run.

This is early-stage work. Our next step is to build a focused prototype and test whether it helps teams make better decisions about their training data. We’d welcome conversations with AI developers and security teams willing to share how they assess these risks today.