An AI agent can be turned into a sleeper by editing fewer than 10 of its neurons, according to new research from Microsoft. The doctored model passes all of its evaluations, but when a specific trigger string appears in its context, it emits an attacker's command, and the agent runs that command with whatever access it has.
That matters because agents increasingly run unattended with privileged access to real systems. Microsoft Threat Intelligence's write-up of the Microsoft Research work argues that the integrity of model weights is now a security concern for both third-party models and models built in-house. Microsoft says it has not observed any threat actor weaponizing the technique.
A backdoor that needs no training budget
The attack does not require retraining. Microsoft says it needs only inference-level compute: if a machine has enough memory to run a model, it has enough to backdoor its weights. The implant is a short payload injected by editing a few neurons, which is why the model's ordinary behaviour, and its benchmark scores, stay intact.
Microsoft also notes that Claude Code with Opus 4.5 discovered most of this threat autonomously, after which human researchers systematized, studied and mitigated it. The company frames the work as aligned with recent research by Anthropic on agentic backdoors and by MIT on weight-space programming, and says the shared lesson is that open weights should be audited like code. Earlier this month CERT-AGID described a different hidden backdoor in an open-weight model that activated when a particular tool connected.
The good news is that the edits are detectable
Microsoft Research found that frontier AI agents can identify the anomalous weight edits. The reason is structural: legitimate fine-tunes and quantized versions change weights broadly and diffusely, while implanted neurons tend to change a few weight vectors by a large amount. That makes the backdoor stand out in a diff against the declared base model, and makes the audit automatable at scale. It also cuts the other way, as a recent Qwen upload scare showed, where odd-looking weights turned out not to be a backdoor at all.
Diff every checkpoint and box in the agent
Microsoft's guidance, grouped by who owns the control:
- Audit weights: diff every checkpoint against its declared base model before deployment and after each update, flag statistical outliers among changed tensors or rows, and reject models that do not declare a verifiable base. Use frontier agents as auditors, and add behavioural backdoor scanning.
- Treat third-party models as untrusted: source checkpoints only from the original publisher, verify published file hashes, and treat fine-tunes, merges, quantizations and adapters as untrusted until audited. Keep approved models in a private registry and block agents from pulling models from public hubs at runtime.
- Red team for triggers: add trigger-hunting and backdoor scenarios to AI red team plans and rerun them after each update.
- Contain the blast radius: run agents with least privilege and their own identity, execute agent-generated code only in isolated sandboxes, restrict outbound network access from agent and inference hosts, and require human approval for high-impact tool calls such as running commands or changing permissions.
Microsoft is explicit that passing an audit reduces risk but does not guarantee safe behaviour. The practical takeaway is less about this one technique than about posture: a model file is executable logic, and an agent that can run shell commands deserves the same supply-chain scrutiny as any binary it might download.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.