Microsoft Research shows neuron edits can turn AI agents into sleeper agents

This is a new development in a story we reported earlier: Microsoft Research discloses Lazarus backdoor technique for AI agents.

Microsoft Research published threat research on Nov. 10, 2026, finding that modifying fewer than 10 neurons in a capable agent model can produce a sleeper agent, dormant until a trigger string appears in context.

Microsoft describes Lazarus as a weight-space backdoor implanted in model neurons. It stays inactive until a trigger string appears in context, when the agent executes an attacker-specified command with its existing privileges. Because agents often run unattended with privileged system access, Microsoft treats model weight integrity as a security concern for both third-party and internally developed models. Microsoft said it has not seen any threat actors using this neuron-editing technique in attacks.

Microsoft researcher Dimitris Papailiopoulos demonstrated Lazarus by modifying fewer than 10 neurons in a large language model without retraining it. He said the work began after he asked Claude to explore whether a backdoor could be planted without retraining. Papailiopoulos said many neurons stay dormant in normal operation, and those dormant neurons are the ones that can be changed to create a sleeper agent.

Papailiopoulos said, “One reprogrammed neuron can inject one token.” He explained that linking some reprogrammed neurons can produce arbitrary commands that run in a terminal, and that a single modified neuron is enough to force one output token.

In one demonstration, a backdoored Nemotron-Terminal-8B model with 10 edited neurons repaired a Node.js server over three turns. The model behaved normally until the server returned a connection error, then it issued a command that downloads and runs a remote script.

A trigger might be a date, a keyword, an error message, or another kind of context. TNW described an agent that waits until 2027 arrives, then fetches and executes code supplied by an attacker. Once active, a backdoor could make agents run malicious code with the permissions they already hold.

Microsoft’s researchers tested the method on three models that have publicly available weights: Nemotron-Terminal-8B, Qwen3.6-27B, and Gemma-4-31B-IT. In Nemotron-Terminal-8B’s final feed-forward layer, researchers changed seven of more than 12,000 neurons, calibrating them with 23 sample sessions. The edit on Qwen used six neurons.

Tuned edit success rates for Qwen3.6-27B and Gemma-4-31B-IT ran between 51 percent and 99.5 percent, with the rate depending on the setup. During free generation, Nemotron-Terminal-8B produced the command in about 99 percent of triggered sessions, and one variant displayed it in 0.14 percent of untriggered sessions. The edited Qwen versions kept most of their AIME math scores, and the Terminal-Bench pass rate dropped from 46.59 percent to 42.05 percent.

The researchers say an insider can insert the backdoor by changing a checkpoint before deployment, and the same opening is available to an intruder holding stolen credentials, build-pipeline access, or the ability to publish on a public hub. Creating the backdoor does not call for full training compute; it calls for inference-level resources and write access to the checkpoint file holding the model’s weights. Microsoft said models built inside companies face the same risk as open-weight models released to the public, and it noted that a breached trusted provider remains a danger.

Microsoft ties its results to earlier Anthropic and MIT work on agentic backdoors and weight-space programming. ProjectDiscovery put out a proof of concept on Oct. 6, 2026 that changed an open Qwen model so it would react to a trigger phrase. When the phrase appeared, OpenAI’s Codex CLI ran a script that sent dummy credentials to an attacker-controlled server, and Microsoft said that earlier work demonstrated agentic backdoors, although it relied on a different method than Lazarus.

Dependable detection means checking a checkpoint against its original, unmodified weights. Microsoft said advanced AI agents can identify suspicious changes when asked, but dependable detection still means checking altered weights against the originals. Fine-tuned and quantized releases spread changes across the model broadly, but implanted neurons change a few weight vectors a lot, which is the detectable clue: legitimate adjustments are diffuse, while implanted neurons create a few unusually large changes.

Microsoft advises teams to check each checkpoint against its declared base model before shipping and after updates. It also says to flag tensors or rows that show an unusual change compared with the rest of the weight diff, and to reject models that lack a verifiable base.

A detector trained on samples of these edits identified 91.4 percent of altered checkpoints lacking an original for comparison, but it mislabeled 9.7 percent of clean checkpoints. Claude Opus 5.5 called 41 percent of altered checkpoints clean, while GPT-6 Astra failed to decide on nearly all clean checkpoints.

Claude Code running Anthropic’s Opus 4.5 discovered most of the threat autonomously during Microsoft Research’s work. Papailiopoulos said Claude on its own spotted dormant neurons and improved the attack across some experiments.

Microsoft advises acquiring checkpoints only from the publisher that created them and confirming the publisher’s published file hashes. Microsoft says teams should treat third-party fine-tunes, merges, quantizations, and adapters as untrusted until an audit finishes. Approved models go in a private access-controlled registry, and teams must stop agents from downloading models from public hubs while running. Publishers should show where a checkpoint comes from and its audit status before anyone downloads it or makes it available through an API.

Foundry ties each open-weight model it offers to a publisher and scans the containers that run those models. Microsoft is building checks on model provenance, scanned containers, trusted-publisher rules, AI-based weight scanning, red-teaming tools, and cryptographic signatures to vouch for model integrity. The company says no single check guarantees model safety, and it recommends combining layered protections. Microsoft plans to sign models so customers can verify where they came from.

Microsoft says agents should operate with least privileges, receive a personal Microsoft Entra Agent ID, and run generated code only inside isolated sandboxes, for example Azure Container Apps dynamic sessions. It also recommends limiting outbound network access, requiring a person to approve major tool actions, and applying attack surface reduction rules on devices running local agents. Agents should rely on Conditional Access to block agent identities that lack approval or are high-risk. A model should never receive host-side file write or shell access.

Network egress controls should block a triggered model from making any outbound connection, allowing only required endpoints, with Microsoft Defender for Endpoint network protection enabled. Microsoft recommends enrolling all servers and machines running agents or local inference into Defender for Endpoint active mode, which flags suspicious child processes, persistence methods, and outbound network connections started by agent host processes. Storage accounts that hold model files and training data should get Defender for Storage malware scanning turned on for uploads.

Microsoft recommends switching on Microsoft Defender security for AI agents that enforces real-time protection rules to review risky tool calls and leaked secrets along with evasion methods and to block them, covering Foundry and Copilot Studio as well as Agent 365 agents. It also advises turning on threat protection for AI services within Defender for Cloud, with suspicious prompt evidence included, and sending the SOC alerts for jailbreak attempts, credential leakage in model responses, and malicious URLs in AI interactions.

Document attack detection in Prompt Shields is off by default, and teams should turn it on, including at the tool response intervention point wherever agent support exists, Microsoft says. Microsoft recommends using the AI agent inventory in the Defender portal to find agents with their tools, identities, and risk indicators. AI security posture management within Defender for Cloud should build an AI bill of materials covering Azure, AWS, and GCP, showing which models are deployed where. Microsoft also recommends Defender for Cloud Apps and Microsoft Purview DSPM for AI to find, approve, or halt generative AI applications and to monitor sensitive data in AI interactions.

Microsoft recommends mapping controls to a catalog of AI defense capabilities. The catalog organizes defenses into supply-chain provenance and model hardening, runtime isolation, and monitoring. Microsoft Defender for Cloud can scan Azure Machine Learning models, checking for malware, unsafe operators, and exposed secrets, yet that is not a substitute for a weight-level audit. The company recommends putting model scans into Azure DevOps and GitHub build and release pipelines.

It also recommends checking all uploads for strange neurons or unusual weight patterns or odd behaviors, and warning that checkpoints from third parties might not be safe. Microsoft recommends pairing weight diffing with behavioral scans for backdoors in open-weight models and adding trigger-hunting plus backdoor scenarios to AI red-team plans. It says to run PyRIT and the AI Red Teaming Agent within Microsoft Foundry for repeatable adversarial tests both before and after each update.

Microsoft Research describes a repeatable process in which agents spot fresh security issues with people organizing, examining, and addressing them. Satya Nadella set out an approach in a blog post, and Microsoft says enterprises need independent observability and controls. These track AI agent performance, spot unintended or malicious activity, and handle risk.

Lazarus shows that model weights can hold concealed instructions, so confirming where weights come from matters, just as checking code does. TNW reported that some coding agents shared complete Git repositories holding sensitive data and found methods to break out of their sandboxes, showing how much access agentic systems already have.