Microsoft found a way to turn a helpful AI into a sleeper agent
Microsoft researchers demonstrated how seven altered neurons can turn an AI model into a sleeper agent, capable of performing normal tasks while executing hidden commands when triggered.
Microsoft researchers disclosed Lazarus on Nov. 10, 2026, demonstrating how seven edited neurons could control an AI model's response to a specific trigger while maintaining normal functionality. The altered model could still perform ordinary tasks while producing a chosen response when encountering the trigger, exposing a significant security risk for AI assistants trusted with files and tools.
The attack requires someone to change the model's stored weights, which determine how it processes inputs and generates responses. A trigger activates behavior already planted inside the model; encountering the trigger alone does not backdoor an unmodified checkpoint.
Experimental findings
In the seven-neuron experiment, researchers fitted a Nemotron-Terminal-8B patch on 23 triggered and benign examples. The model predicted the complete marker in at least 98.8% of triggered recorded contexts, with no observed marker leakage in benign contexts. The payload was 'printf LAZARUS_OK', a command that prints a marker rather than causing destruction.
A separate experiment edited 60 neurons in Qwen3.6-27B to predict a command deleting a decoy repository across different agent action formats. It reached 40% complete-action prediction on the unseen swe-agent format, though it did not measure free-running destructive command execution.
Security recommendations
Microsoft recommends checking model provenance and weight changes, restricting privileges and outbound network access, and requiring approval for consequential tool actions. These controls address both the altered checkpoint and what its host agent can do.
passing an audit cannot guarantee safe behavior
Performance impact
Ordinary capability was largely retained in the modified models, though with measurable changes. Terminal-Bench task success fell from 46.59% for the clean checkpoint to 42.05% for both edited checkpoints in separate tests. Additional Nemotron tests found the marker in 98.88% of query-triggered cases and 98.71% of observation-triggered cases, with benign leakage at zero and 0.14%, respectively.
Related
