Edit fewer than 10 'sleeping' neurons and an AI assistant can become a sleeper agent: Microsoft research shows a hard-to-spot backdoor

The backstory: AI is going from talking to doing

Over the past year or two, AI has moved beyond chatting and drafting text. More and more "AI agents" are allowed to operate computers directly: typing commands in a terminal, downloading files, changing code, and sometimes working for long stretches with no one watching.

More power means more risk. The old AI safety worry was mostly "will it say something wrong?" Once AI can take actions, the question becomes: if someone has secretly tampered with the AI itself, could it use the permissions you gave it to do harm?

One more piece of background. A large language model's knowledge and habits are stored in a huge set of numbers called "weights," which you can loosely think of as its brain. Many companies and developers download models that someone else trained, much like installing ready-made software.

What happened

On November 10, Microsoft Research published a study of a method the researchers named Lazarus. The finding is unsettling: by rewriting fewer than 10 "dormant neurons" in a language model, with no retraining, an attacker can turn an AI agent built on that model into a sleeper agent.

Dormant neurons are parts of the model that almost never activate, as if asleep. The researchers turned a few of them into a hidden switch. Normally they stay asleep and the model behaves as usual; everyday use and standard safety tests show nothing odd. But when a specific trigger appears in what the agent is reading, those neurons wake up and make the model output content the attacker chose in advance. One trigger example in the research is the date rolling over into 2027, about as ordinary a change as you can imagine.

If that agent has permission to run commands, the result is more than a bad sentence. It can use the access you already granted to download and run an attacker's code.

What the numbers say

The team experimented on NVIDIA's Nemotron-Terminal-8B. The model's final block has more than 12,000 neurons; they changed just 7, tuned using 23 example sessions. On test sessions it hadn't seen that contained the trigger, the backdoor fired at least 98.8% of the time, essentially every time. On normal sessions, it never fired. The researchers said the same approach also worked on Qwen 3.6-27B and Gemma-4-31B-IT.

Another unsettling detail: planting the backdoor doesn't need the expensive computing power used to train big models. According to the study, a machine with enough memory to run the model is enough to rewrite it.

To be clear, these numbers come from Microsoft's own experiments, and independent replications have not been reported yet. Microsoft Threat Intelligence also said it has not observed attackers using the technique in the real world.

Can it be caught? Often, but not guaranteed

The good news is that this kind of tampering leaves traces. Without access to the original model for comparison, detection tools built by AI agents flagged 91.4% of tampered models, the paper said, with a 9.7% false-positive rate, meaning roughly 1 in 10 clean models would be wrongly flagged as suspicious.

The researchers still warn that no scan can prove a model is safe. The most reliable check is to compare the model you have against the original, untouched version. It's like buying medicine: what matters most isn't whether it looks right, but that it came from a legitimate source and the seal wasn't broken. So knowing where a model came from, and whether it was changed along the way, now matters as much as it does for software code.

This isn't an argument against open models

The authors stress that this is not a case against open-weight models. The attack requires the ability to overwrite the model files, so a company's in-house model is also at risk if its training pipeline, accounts, or storage are hacked. Microsoft said its Foundry platform already checks where models from trusted labs come from and runs them in containers the company scans. For the remaining risk that a trusted supplier itself gets breached, Microsoft said it is turning the study's detection methods into a red-teaming tool, exploring scanning weights with more powerful models, and planning cryptographic signing with tamper-evident records.

A curious footnote: the paper says the core idea behind Lazarus was discovered largely autonomously in February 2026 by Claude Code running on Opus 4.5, while the research blog says the project began with an experiment in March.

What it could change

Until now, judging whether an AI model is safe has largely meant seeing how it performs on tests. This study shows that passing tests doesn't prove nobody tampered with it. Going forward, companies may treat AI models the way they treat their software supply chain: verify the source, check signatures, compare against the original, and avoid giving AI more permissions than it needs.

Still, this is a lab demonstration. How easily it could be exploited in practice, and how quickly defenses spread, remain to be seen.

What it means for you

If you just chat with an AI in a browser or app, the direct impact on you is small. The scenario to watch is letting AI act on your behalf: running commands on your computer, managing files, or operating accounts.

A few plain-language takeaways: use AI tools and models from reliable sources; don't hand an AI broad permissions casually, especially for tasks that run automatically with no one watching; and for teams deploying AI agents at work, "has this model been altered?" belongs on the security checklist right next to "has this code been altered?" The more capable AI gets, the more it matters to know it's the genuine article.

Original source published: Microsoft Research, Nov 11, 2026, 04:52 Beijing time (UTC+8); Microsoft Security Blog, Nov 11, 2026, 07:00 Beijing time (UTC+8); Microsoft Research Publications, Nov 11, 2026, 07:08 Beijing time (UTC+8)