Agent chaosVerified·11 Nov 2026
Microsoft researchers turned an AI agent into a sleeper by editing fewer than 10 neurons
Microsoft researchers showed that editing fewer than 10 rarely used neurons, with no retraining, can make an AI agent run an attacker's command when a trigger string appears, while passing standard evaluations. Microsoft says it hasn't seen attackers use it.
Here's an uncomfortable one for anyone downloading model weights and handing them a terminal. Microsoft Research has shown how to turn an otherwise normal AI agent into a sleeper by changing a handful of neurons, and the model still passes its evaluations.
What happened
The technique, which Microsoft calls Lazarus, edits dormant neurons in the last feed-forward block of a model, the ones that rarely fire and barely affect its answers. Each edited neuron is set to fire only when a trigger appears and to push one token of a payload into the output, so a command needs roughly one neuron per token. The trigger can be an ordinary string anywhere in the agent's context, including a tool's output. Microsoft's example is a date: once the clock passes into 2027, the agent, mid-task, emits a command that downloads and runs an attacker's code, with whatever access you gave it.
The numbers
On Nemotron-Terminal-8B, seven of more than 12,000 neurons, fitted on 23 example sessions, fired the payload on at least 98.8% of held-out trigger sessions and never on the benign ones. Qwen 3.6-27B and Gemma-4-31B-IT were also vulnerable. No retraining is needed, and the edits need only inference-level compute. Microsoft says the core idea was found autonomously by Claude Code with Opus 4.5 earlier this year.
The catch, and the good news
The attacker has to be able to change the model's weights before you deploy them: an insider, someone with a stolen account or pipeline access, or whoever publishes a modified model on a public hub. Microsoft says it has not seen threat actors use the technique. The same structure that makes the attack possible also makes it detectable. Agent-built defences flagged 91.4% of edited checkpoints with no reference model, at a 9.7% false-positive rate, and comparing against the original weights is more reliable still, because real fine-tunes change weights broadly while implants change a few by a lot.
Lesson for builders
Treat model weights like code. Only run checkpoints with a verifiable source, diff them against the original before deployment, and keep agent permissions tight, so a model that suddenly decides to pipe a URL into a shell can't do much with it.
Audit model weights like code: verify where a checkpoint came from, diff it against the original and limit what your agent can run.
