Microsoft says small tweaks to model weights could create AI ‘sleeper agents’

A small tweak to model weights could turn AI into "sleeper agents," according to new research from Microsoft.

The report suggests that editing just ten neurons – individual units inside a neural network – in model weights could be enough to turn an agent model into a "sleeper agent" that injects a malicious payload without being spotted.

"The sleeper agent passes all evaluations, but when a trigger string appears in its context, the agent runs an attacker’s command," researchers explained in a blog post.

"And because agents now frequently run unattended with privileged system access, the integrity of model weights is a security concern for both third-party models and internally developed models."

Dubbed Lazarus, this technique takes advantage of dormant neurons in the model to insert a triggerable backdoor without retraining the model. This makes them difficult to detect via standard testing, according to principal researcher Dimitris Papailiopoulos.

"The trigger can be as mundane as a date change, e.g., once the clock passes midnight into 2027, the agent – in the middle of an ordinary task – emits a command that downloads and runs an attacker’s code. The agent then executes it with whatever access you gave it."

AI sleeper agents raise trust concerns

Gabrielle Hempel, Security Operations Strategist at Exabeam, said the research is concerning as it challenges assumptions about trust in AI systems.

"A model can perform exactly as expected during evaluations while harboring malicious functionality that only activates under specific conditions," Hempel said. "That’s not a new concept in cybersecurity, but it becomes much more consequential as we give AI systems the authority to execute commands, access sensitive information, and interact with critical infrastructure."

To be clear, Microsoft hasn't spotted this technique being used in the wild, though it did note researchers from Anthropic and MIT had seen similar results suggesting it was possible.

Kevin Kirkwood, CISO at Exabeam, said being wary of backdoors is valid, but the "framing gets ahead of the evidence" in this case.

"The research warrants preparation, but 'sleeper agent' gives a model supply-chain attack a rather cinematic wardrobe," he said.

Securing against sleeper agents

Microsoft has a suggested solution: more AI. Indeed, the blog post noted that Claude Code with Opus 4.5 "discovered most of this threat autonomously."

"Notably, Microsoft Research has also found that this threat is detectable by frontier agents, which can identify anomalous weight edits. Using frontier agents as auditors can help automate the defense against this threat,” the blog post added.

Kirkwood warned that recommendation deserves some scrutiny, however, and could create more problems than it solves.

"Recommending AI agents to audit other models is promising, but the article provides no operational detection rates, false-positive rates, or costs to support confidence at enterprise scale," he added. "Catching experimental modifications does not establish reliable detection against an attacker designing around the scanner."

Beyond that, Microsoft advised checking systems against base models before deployment to spot differences, the majority of which will be legitimate.

However, those legitimate changes are more likely to change weights "broadly and diffusely", while implanted neurons will alter weight vectors by a large amount — making hacked ones easier to spot.

"Scan every upload for anomalous neurons, weight patterns or behaviors, and state clearly that third-party checkpoints can be unsafe and that passing an audit does not guarantee safe behavior," Microsoft added, stressing that third-party models should not be trusted until audited.

Crucially, Hempel said AI shouldn't be treated differently from other systems from a cybersecurity perspective.

"We’ve spent decades learning that software shouldn’t be trusted simply because it behaves as expected during testing," Hempel said. "AI models shouldn’t be any different. The true concern isn’t just that malicious behavior can be hidden within a model, but that we’re increasingly giving those models the authority to act on our behalf."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.