AI · 1 day ago
Microsoft researchers demonstrated a weight-level backdoor across three open-weight models, editing as few as six rarely used neurons so an AI agent would produce and execute an attacker-chosen command.
The altered neurons stay quiet in ordinary use and activate when a chosen phrase appears in a user's request or a tool's reply; they then steer the model to emit the command. In recorded Nemotron-Terminal-8B tests, a harmless marker command appeared in at least 98.8% of triggered sessions and none of the trigger-free sessions checked. The altered models still passed ordinary evaluations.
For teams running agents on open-weight models, a trigger in user input or tool output can inherit the agent's command permissions. The attacker must first alter the weights; Microsoft says it has seen no real-world use.
4 sources covering this story
Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor
Microsoft researchers say a handful of rewritten neurons can let a model pass every test and then hand an attacker the agent’s access.
Microsoft researchers demonstrate hidden backdoor technique for AI agents - Help Net Security
Microsoft shows how hidden AI backdoors evade safety tests and why sleeper agent detection requires auditing model weight changes.
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
Microsoft demonstrates how editing as few as six AI model neurons can plant backdoors that trigger command execution by agents.
Detecting sleeper agents hiding in AI model neurons | Microsoft Security Blog
Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload; Microsoft Research has also found that this threat is detectable by frontier agents, which can identify anomalous weight edits.
Part of the PlainSec briefing for 2026-11-12