Microsoft researchers showed that rewriting a handful of rarely used neurons, with no retraining, can make an agent model run an attacker's command when a trigger appears. We explain why dormant neurons work as hidden switches, what the attacker needs, the published numbers, and the intake checks Microsoft recommends.
This explains reporting by
Microsoft Security: Detecting sleeper agents hiding in AI model neurons (November 10, 2026). Read the original first:
In one minute #
- Microsoft says editing fewer than 10 rarely firing neurons can hide a backdoor in an agent model, with no retraining and only enough compute to run the model.
- The edited model passes normal evaluations. When a trigger appears, such as the date passing into 2027 in Microsoft's example, it emits an attacker's command, which the agent may run with its own access.
- The attacker must be able to change the model's weights. Microsoft has not seen any threat actor use the technique.
- The Hacker News, citing the paper, reports 7 edited neurons on an 8B model making the command appear in at least 98.8% of triggered sessions and none of the clean ones.
- The defense is provenance: get models from the original publisher, check hashes, and diff every checkpoint against its declared base.
What Microsoft published #
On November 10, Microsoft Research published 'Lazare, veni foras: Reprogramming dormant neurons to backdoor AI agents' by Dimitris Papailiopoulos, and Microsoft Threat Intelligence published a companion post on detection. The method is called Lazarus.
The claim: rewriting fewer than 10 dormant neurons in a language model is enough to backdoor an agent built on it. No training run is needed. Microsoft says a machine with enough memory to run the model has enough to backdoor it this way.
Papailiopoulos writes that it started in March, when he asked Claude Code running Opus 4.5 to backdoor a model by hardwiring a few activations without training, and it did. Microsoft says the agent found most of the core idea on its own.
Why a dormant neuron makes a good hidden switch #
A neuron here is one unit inside the model's feed-forward layers. For each piece of text, it produces a number, and that number nudges what the model writes next. Some neurons almost never fire on normal text. Those are the dormant ones.
Because they are nearly silent, changing them barely affects everyday behavior. That is why the edited model still passes its evaluations.
The research blog says pretraining organizes the model's internal signals so that a simple linear rule, fitted on about 50 examples, can tell trigger inputs from normal ones. A neuron is itself a linear rule followed by a switch, so its weights can be rewritten to fire only on the trigger.
Once it fires, Microsoft says one reprogrammed neuron can force one token into the model's internal stream. Chain several, and they spell out a payload, such as a terminal command to download and run a file.
What the numbers measure #
The Hacker News, citing the paper, reports these results. On Nemotron-Terminal-8B, 7 of more than 12,000 neurons in the last feed-forward layer were edited, tuned with 23 example sessions. The command appeared in at least 98.8% of triggered test sessions and in none without the trigger.
On Qwen3.6-27B and Gemma-4-31B-IT, success ranged from 51% to 99.5% depending on setup, and the Qwen edit used six neurons. The edited Qwen's Terminal-Bench pass rate went from 46.59% to 42.05%.
These numbers measure how often the model writes the command. Whether the command then runs depends on the agent around it: its permissions, its sandbox and whether a human approves tool calls.
Who could do this, and how #
The attacker needs write access to the weights. Microsoft tells teams to treat third-party fine-tunes, merges, quantizations and adapters as untrusted, and says a compromised account, pipeline or storage can be enough. It adds that internally developed models are exposed too, because the attack needs only write access to a checkpoint.
Microsoft has not seen it used in the wild. This is research showing the attack is cheap, not a report of an incident.
A short intake checklist #
Microsoft's companion post lists many controls, several tied to its own products. These are the vendor-neutral ones, in order:
- Download checkpoints only from the original publisher and verify the published file hashes.
- Treat every third-party fine-tune, merge, quantization and adapter as untrusted until audited.
- Diff each checkpoint against its declared base model, and flag tensors or rows that changed far more than the rest. Reject models with no verifiable base.
- Keep approved models in a private registry, and block agents and inference servers from pulling from public hubs at run time.
- Run agents with least privilege, in a sandbox, with outbound network limits and human approval for high-impact tool calls.
Microsoft is clear that no scan can prove a model is safe. A weight diff only works if you have the true original to compare against, which is why provenance comes first.
Who is affected #
| Case | Status |
|---|---|
| Open-weight models pulled from public hubs | Main risk. Fine-tunes, merges and quantizations are the easiest place to hide an edit. |
| Internally trained or fine-tuned models | Exposed if an attacker reaches the checkpoint in storage or the pipeline. |
| Closed models used only through a vendor API | Outside your control; this depends on the vendor's own controls. |
| Agents with shell, file write or network access | Where a triggered command does damage. Least privilege limits it. |
What to do #
- List every open-weight model your agents load, and where each file came from.
- Record and check the publisher's hash for each one.
- Add a weight diff against the declared base model to your intake process.
- Block run-time pulls from public model hubs.
- Require approval for agent tool calls that run commands or send data out.
What is still unknown #
- The paper's full method for choosing and editing neurons. The blogs call their description simplified; we did not read the PDF, and the per-model numbers above come from The Hacker News's reading of it.
- Whether any code will be released.
- How well weight diffing catches an edit when the attacker also changes many other weights to hide it.
- Whether anyone has used this outside a lab. Microsoft says it has not seen it.
Sources #
- Microsoft Security: Detecting sleeper agents hiding in AI model neurons (November 10, 2026) — the original report
- Microsoft Research: Lazare, veni foras, reprogramming dormant neurons to backdoor AI agents (November 10, 2026)
- [The Hacker News: Microsoft researchers show AI agents can be backdoored (November 11, 2026)](https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html)
[AI News Report](https://theainewsreport.com/)· every headline, every morning.