---
title: Microsoft Research: editing fewer than 10 neurons can turn an agent model into a sleeper agent that passes evaluations and runs an attacker's command on a trigger | ctxsec
url: https://ctxsec.com/items/microsoft-research-sleeper-agent-fewer-than-ten-neurons-weight-edit-backdoor
description: "Microsoft says its researchers could implant a short payload into a capable agent model by editing fewer than 10 neurons. The model passes all evaluations, but when a trigger string appears in its context it emits the attacker's command, which the agent then runs with whatever access it has. The edit needs only inference-level compute, so any machine that can run the model can backdoor it. Microsoft says Claude Code with Opus 4.5 discovered most of the threat autonomously, that frontier agents can also detect such anomalous weight edits, and that it hasn't observed threat actors weaponizing it."
status: "official (Microsoft Security Blog / Microsoft Research, Nov 10, 2026); research finding, Microsoft says it has not seen attackers use the technique"
published: 2026-11-10
---

> Microsoft says its researchers could implant a short payload into a capable agent model by editing fewer than 10 neurons. The model passes all evaluations, but when a trigger string appears in its context it emits the attacker's command, which the agent then runs with whatever access it has. The edit needs only inference-level compute, so any machine that can run the model can backdoor it. Microsoft says Claude Code with Opus 4.5 discovered most of the threat autonomously, that frontier agents can also detect such anomalous weight edits, and that it hasn't observed threat actors weaponizing it.

[← AI](/ai) · [markdown](/items/microsoft-research-sleeper-agent-fewer-than-ten-neurons-weight-edit-backdoor.md)

official (Microsoft Security Blog / Microsoft Research, Nov 10, 2026); research finding, Microsoft says it has not seen attackers use the technique

2026-11-10

### Microsoft Research: editing fewer than 10 neurons can turn an agent model into a sleeper agent that passes evaluations and runs an attacker's command on a trigger

- **Audit weights like code:** diff every checkpoint against its declared base model before deployment and after updates. Fine-tunes and quantizations change weights broadly; implanted neurons change a few vectors a lot, so flag statistical outliers and reject models without a verifiable base.
- **Treat third-party fine-tunes, merges, quantizations and adapters as untrusted** until audited; pull checkpoints only from the original publisher and verify hashes; serve from a private registry rather than public hubs at runtime.
- **Contain the blast radius:** least-privilege agent identities, sandboxed code execution, egress allowlists, and human approval for high-impact tool calls, so a triggered model can't do much.

Sources: [Microsoft Security Blog: Detecting sleeper agents hiding in AI model neurons (Nov 10, 2026)](https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/) · [Microsoft Threat Intelligence on X (Nov 10, 2026)](https://x.com/MsftSecIntel/status/2120299667443396688)