Microsoft researchers show an AI agent can be secretly rigged by changing fewer than 10 of its ‘neurons,’ and urge companies to check AI models like code
The tampered model passed safety tests, then had its agent run an attacker’s command when a trigger such as a date appeared. Microsoft says it has not seen criminals use the trick.
Someone who can alter the files of an AI model can plant a hidden “sleeper” command by changing fewer than 10 of its internal units, Microsoft researchers reported Nov. 10. The tampered model behaves normally and passes standard tests until a trigger appears. Then it makes the AI agent it powers run the attacker’s command.
The risk is greatest for AI agents, programs that use a model to carry out tasks on a computer, such as running commands or editing files, often with no one watching. A rigged agent could quietly download and run harmful code, steal secrets or run destructive commands, Microsoft said. The company said it has not seen attackers use the method.
How the trick works
Large language models, the systems behind chatbots such as ChatGPT, are built from billions of numbers called weights, grouped into units often called neurons. Many neurons rarely switch on. The researchers, who named the technique Lazarus, found they could reprogram a few of those idle neurons to fire only when a trigger appears, for example once the clock passes midnight into 2027, and to make the model type out a command. No retraining is needed: any computer with enough memory to run the model can alter it this way.
Microsoft principal researcher Dimitris Papailiopoulos wrote that the work began in March as a quick experiment in which he asked Anthropic’s Claude Code AI assistant to plant such a backdoor, and that the tool discovered most of the method on its own.
What Microsoft says companies should do
- Compare every model against the original publisher’s version before using it. Real updates change many weights slightly, while planted edits change a few weights a lot.
- Get models only from the original publisher and check its published file fingerprints, called hashes.
- Give AI agents only the access they need, run the code they write in a sealed-off “sandbox” and require a person to approve risky actions, such as running commands or sending data out.
Microsoft said leading AI agents can spot such edits when asked to scan a model’s weights, but no scan can prove a model is safe. It said the threat is not an argument against “open-weight” models, which anyone can download, because a company’s own models are just as exposed if an insider or hacker gets write access to the files.