Quantization-conditioned backdoors reach 100% attack success while the FP checkpoint passes audit.

AGENTQ is the first study of this attack against agents rather than free-text generation, where the payload is a structured function call nobody reads (arXiv 2609.14060). Naive adaptation of prior backdoor methods wrecks benign utility; AGENTQ combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class to keep normal capability intact. Up to 100% post-quantization attack success across three trigger-action pairs and NF4, FP4 and INT8. If you audit open weights at full precision and ship them quantized, you audited a different model.