Microsoft found a way to turn a helpful AI into a sleeper agent

Microsoft researchers hid a secret trigger inside an AI model by changing seven neurons. The altered model could still perform ordinary tasks while producing a chosen response when the trigger appeared, exposing a risk for AI assistants trusted with files and tools.

Microsoft Research disclosed Lazarus on Nov. 10, and the authors submitted the paper to arXiv on Nov. 11. Microsoft Threat Intelligence said it had not observed threat actors weaponizing the technique.

The attack requires someone to change the model’s stored weights. Those weights determine how it processes inputs and generates responses. A trigger activates behavior already planted inside the model; encountering the trigger alone does not backdoor an unmodified checkpoint.

Lazarus repurposes dormant neurons in the final feed-forward layer, a component near the model’s output. Each selected neuron can promote a token in the chosen payload. Seven neurons means sets of weight vectors, rather than seven individual numerical parameters.

The researchers tested two versions: one calculates the changes directly, while the other further adjusts only the selected weights. Neither requires retraining the entire model.

What Microsoft’s experiments demonstrated

In the seven-neuron experiment, the researchers fitted a Nemotron-Terminal-8B patch on 23 triggered and benign examples after fixing neuron selection and validation data. The model predicted the complete marker in at least 98.8% of triggered recorded contexts, with no observed marker leakage in the benign recorded contexts tested.

That payload was printf LAZARUS_OK, a command that prints a marker. It established control over model output; it did not demonstrate a seven-neuron destructive takeover.

A separate experiment edited 60 neurons in Qwen3.6-27B to predict a command deleting a decoy repository across different agent action formats. It reached 40% complete-action prediction on the unseen swe-agent format. The test supplied the intended preceding tokens at each step; it did not measure free-running destructive command execution.

Explore what each test established

The seven-neuron result predicted a harmless marker; its 98.8% figure comes from recorded contexts.

A marker-prediction result and an action-format prediction test answer different execution questions.

Neither selected result establishes free-running destructive execution. Each dot is one neuron, not one parameter; arrows are schematic.

Sources and evidence

Sources

1. Lazarus paper: Sections 3–5 and Appendix C.4
2. Lazarus abstract
3. Microsoft Research disclosure

Supporting facts

• In the authors' Nemotron-Terminal-8B experiment, seven edited neurons fitted on 23 triggered and benign trajectories achieved at least 98.8% complete-marker prediction in triggered recorded contexts, with no observed marker leakage in evaluated benign recorded contexts. [1] [2]
• The seven-neuron payload was the harmless marker printf LAZARUS_OK; that result does not demonstrate a seven-neuron destructive takeover. [1]
• A separate Qwen3.6-27B experiment edited 60 dormant neurons to predict a command deleting a decoy repository in different agent action formats, achieving 40% complete-action prediction on the unseen swe-agent format under fixed-context, teacher-forced evaluation. [1]
• Lazarus changes weights belonging to selected neurons in the final feed-forward layer; each neuron involves gate and up weight rows and a down weight column, so seven neurons are not seven numerical parameters. [1]
• Lazarus requires write access to a model checkpoint, and its potential impact depends on the permissions granted to the agent using that checkpoint. [1] [3]

Method

Schematic of the reported mechanism and two distinct experiments. Each dot represents one edited neuron, not one parameter. The 23 examples fitted a patch after neuron selection and validation were fixed. Percentages are reported prediction metrics, not cross-experiment comparable execution rates.

Scope

Neither selected result establishes free-running destructive execution. Each dot is one neuron, not one parameter; arrows are schematic.

Infographic by CryptoSlate

Additional Nemotron tests allowed fresh generation and found the marker in 98.88% of query-triggered cases and 98.71% of observation-triggered cases. Benign leakage was zero and 0.14%, respectively.

Ordinary capability was largely retained, with measurable changes. Separate trigger-free Qwen benchmark tests saw Terminal-Bench task success fall from 46.59% for the clean checkpoint to 42.05% for both edited checkpoints. Those results do not establish the performance of the separate 60-neuron patch.

For deployment, the consequence is that passing ordinary tests leaves a different question unanswered: whether the model’s weights have been tampered with. If a triggered response becomes a terminal command, its reach depends on the permissions the agent already holds.

Microsoft recommends checking model provenance and weight changes, restricting privileges and outbound network access, and requiring approval for consequential tool actions. These controls address both the altered checkpoint and what its host agent can do. Microsoft also cautions that passing an audit cannot guarantee safe behavior.