AI Security
Microsoft model backdoor can steer agents to run commands Microsoft researchers demonstrated a weight-level backdoor across three open-weight models, editing as few as six rarely used neurons so an AI agent would produce and execute an attacker-chosen command.
The altered neurons stay quiet in ordinary use and activate when a chosen phrase appears in a user's request or a tool's reply; they then steer the model to emit the command. In recorded Nemotron-Terminal-8B tests, a harmless marker command appeared in at least 98.8% of triggered sessions and none of the trigger-free sessions checked. The altered models still passed ordinary evaluations.
For teams running agents on open-weight models, a trigger in user input or tool output can inherit the agent's command permissions. The attacker must first alter the weights; Microsoft says it has seen no real-world use.
4 sources · Nov 11
Timeline Sources Nov 11 CSO Online
Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor
Microsoft researchers say a handful of rewritten neurons can let a model pass every test and then hand an attacker the agent’s access.
original Nov 11 Help Net Security
Microsoft researchers demonstrate hidden backdoor technique for AI agents - Help Net Security
Microsoft shows how hidden AI backdoors evade safety tests and why sleeper agent detection requires auditing model weight changes.
original Nov 11 The Hacker News
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
Microsoft demonstrates how editing as few as six AI model neurons can plant backdoors that trigger command execution by agents.
original Part of the PlainSec briefing for 2026-11-12
Every edition of this story: Microsoft model backdoor can steer agents to run commands
AI Security
Microsoft model backdoor can steer agents to run commands Microsoft researchers demonstrated a weight-level backdoor across three open-weight models, editing as few as six rarely used neurons so an AI agent would produce and execute an attacker-chosen command.
The altered neurons stay quiet in ordinary use and activate when a chosen phrase appears in a user's request or a tool's reply; they then steer the model to emit the command. In recorded Nemotron-Terminal-8B tests, a harmless marker command appeared in at least 98.8% of triggered sessions and none of the trigger-free sessions checked. The altered models still passed ordinary evaluations.
For teams running agents on open-weight models, a trigger in user input or tool output can inherit the agent's command permissions. The attacker must first alter the weights; Microsoft says it has seen no real-world use.
4 sources · Nov 11
Timeline Sources Nov 11 CSO Online
Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor
Microsoft researchers say a handful of rewritten neurons can let a model pass every test and then hand an attacker the agent’s access.
original Nov 11 Help Net Security
Microsoft researchers demonstrate hidden backdoor technique for AI agents - Help Net Security
Microsoft shows how hidden AI backdoors evade safety tests and why sleeper agent detection requires auditing model weight changes.
original Nov 11 The Hacker News
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
Microsoft demonstrates how editing as few as six AI model neurons can plant backdoors that trigger command execution by agents.
original Part of the PlainSec briefing for 2026-11-12
Every edition of this story: Microsoft model backdoor can steer agents to run commands