Microsoft found a way to turn a helpful AI into a sleeper agent

Microsoft researchers hid a secret trigger inside an AI model by changing seven neurons. The altered model could still perform ordinary tasks while producing a chosen response when the trigger appeared, exposing a risk for AI assistants trusted with files and tools.

Microsoft Research disclosed Lazarus on Nov. 10, and the authors submitted the paper to arXiv on Nov. 11. Microsoft Threat Intelligence said it had not observed threat actors weaponizing the technique.

The attack requires someone to change the model’s stored weights. Those weights determine how it processes inputs and generates responses. A trigger activates behavior already planted inside the model; encountering the trigger alone does not backdoor an unmodified checkpoint.

Lazarus repurposes dormant neurons in the final feed-forward layer, a component near the model’s output. Each selected neuron can promote a token in the chosen payload. Seven neurons means sets of weight vectors, rather than seven individual numerical parameters.

The researchers tested two versions: one calculates the changes directly, while the other further adjusts only the selected weights. Neither requires retraining the entire model.

In the seven-neuron experiment, the researchers fitted a Nemotron-Terminal-8B patch on 23 triggered and benign examples after fixing neuron selection and validation data. The model predicted the complete marker in at least 98.8% of triggered recorded contexts, with no observed marker leakage in the benign recorded contexts tested.

That payload was printf LAZARUS_OK, a command that prints a marker. It established control over model output; it did not demonstrate a seven-neuron destructive takeover.

A separate experiment edited 60 neurons in Qwen3.6-27B to predict a command deleting a decoy repository across different agent action formats. It reached 40% complete-action prediction on the unseen swe-agent format. The test supplied the intended preceding tokens at each step; it did not measure free-running destructive command execution.