Microsoft Research: detecting sleeper agents hidden in AI model neurons

Microsoft Research released threat research stating that editing fewer than 10 neurons and injecting a short payload can turn a fairly capable agent model into a sleeper agent that can pass all evaluations and execute the attacker's commands when a trigger string appears in context. Planting such a backdoor requires only inference-level compute; any machine with enough memory to run the model can do it in weight space. Claude Code paired with Opus 4.5 autonomously discovered most of this threat. Microsoft said it has not yet observed threat actors weaponizing the technique, but the research found that frontier agents can identify anomalous weight edits and could serve as automated auditors in model admission processes. Microsoft also gave layered defense recommendations, including comparing checkpoints with the declared base model by weights before deployment, treating third-party models as untrusted, running agents with least privilege and in a sandbox, and requiring human approval for high-risk tool calls.