i think what they're talking about is an attacker poisoning the data the agent is trained upon to include functionality/a backdoor that can later, after training and when the agent is deployed, be used to induce unwanted behaviour.