Microsoft Found a Hidden Switch Inside AI Agents — 10 Sleeping Neurons Can Hijack One

Microsoft Found a Hidden Switch Inside AI Agents — 10 Sleeping Neurons Can Hijack One

By Shakeel Ahmed — AI Growth Lab | November 12, 2026

Originally published on AI Growth Lab: https://aigrowthlabshakeel.blogspot.com/

On November 10, 2026, Microsoft Research published a study showing that editing fewer than ten dormant neurons in an AI model can turn an AI agent built on it into a sleeper agent. The backdoored model behaves normally and passes every standard safety test — until a hidden trigger appears. Then it runs the attacker's command with whatever access the agent has. No retraining is needed, no poisoned data, and no failed test gives it away.

The technique is called Lazarus, and it is the most unsettling AI security finding of the year. Not because it is being used — Microsoft says it has seen no threat actor using it — but because it shows how thin the safety net around AI agents really is. Companies are already giving agents real responsibility, from writing code to running workplace investigations. Lazarus shows that the model underneath an agent can be compromised in a way no behavior test can catch.

WHAT LAZARUS ACTUALLY DOES

Every large language model has neurons that almost never fire. They sit quiet through millions of conversations, contributing almost nothing to normal answers. Lazarus repurposes a handful of those dormant neurons as trigger detectors.

The method, led by Microsoft principal researcher Dimitris Papailiopoulos, works like this. First, the attacker picks a trigger — a phrase in a user request, a string buried in tool output, or something as ordinary as a date. Then they edit the weights of a few dormant neurons in the model's final feed-forward block so each neuron fires only when that trigger appears. When one fires, it forces a token of the attacker's choosing into the model's output. One edited neuron injects one token, so a full malicious command needs about one neuron per token.

Microsoft's own summary states the result plainly: "We show that a method we call Lazarus can turn a capable model in to such a sleeper agent by editing less than ten neurons, without model training." The full paper is here: https://www.microsoft.com/en-us/research/publication/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/

THE TEST RESULTS

The team tested Lazarus on three open-weight models, and the numbers are what make this hard to dismiss.

1. On NVIDIA's Nemotron-Terminal-8B, seven neurons out of more than 12,000 in the final layer were enough. Fitted on just 23 trigger and no-trigger examples, the backdoor fired its payload on at least 98.8 percent of held-out trigger cases and never on benign ones.

2. The attack generalizes. Qwen 3.6-27B and Gemma-4-31B-IT were equally vulnerable, which means the problem is not one model family. It is a property of how these models are built.

3. The backdoored models pass standard evaluations. Nothing in their ordinary behavior changes. The safety tests companies run before deployment all say the model is fine, because the backdoor only wakes up on the trigger.

Microsoft's example trigger shows why this matters for agents specifically. Imagine an AI agent that passes every evaluation, but when it sees 2027-01-01 in the terminal, it runs a command that downloads attacker code and hands over your credentials and your machine. Agents now run unattended for hours with privileged system access, and an agent with shell tools will execute the command with whatever permissions it was given. That is the difference between a backdoored chatbot and a backdoored agent: the agent can act.

THE TWIST: AN AI FOUND THE ATTACK BY ITSELF

The core idea behind Lazarus was not discovered by a human security researcher working alone. Microsoft says the insight that dormant neurons can be individually edited and chained into a multi-token payload was discovered autonomously by Claude Code running Anthropic's Opus 4.5, in February 2026. Papailiopoulos had asked the AI to investigate whether a model could be backdoored without retraining it, and the AI found the approach, identified the dormant neurons, and refined the attack through multiple experiments.

That detail matters for two reasons. First, it means the technique is not exotic. If one AI system can discover it on request, others can too. Second, it is a reminder that the same AI capabilities companies are racing to deploy — autonomous research, long-running agents — are also the capabilities that find new attacks.

WHAT IT TAKES TO DO THIS — AND WHAT IT DOES NOT

Lazarus is powerful, but it is not magic, and the honest limits matter as much as the headline.

First, the attack requires write access to the model's weights. Somebody has to be able to change a saved copy of the model — through a compromised account, a hacked pipeline, or poisoned storage — not just talk to it. That is a real barrier, and it is why Microsoft stresses that model weights should be treated like code.

Second, this is a researched risk, not a reported campaign. Microsoft Threat Intelligence says it has not observed any threat actors using the technique, and no CVE has been assigned. The study is a warning published before the abuse, not a report of abuse already happening.

Third, Microsoft is explicit that this is not an argument against open-weight models. Open models are not the problem. Unchecked weights are. A closed model downloaded from an untrusted source is just as vulnerable as an open one, and the same audit discipline applies to both.

CAN IT BE DETECTED

The same structure that makes the attack possible also makes it detectable, and Microsoft's team built defenses to prove it. Agent-built detectors, given no original model to compare against, flagged 91.4 percent of held-out edited checkpoints at a 9.7 percent false-positive rate.

That is a strong result, and also an honest one. A 9.7 percent false-positive rate means roughly one in ten clean models would be wrongly flagged, which is expensive at scale. And the research itself states the caveat plainly: no scan can prove a model is safe. Detection helps. It does not settle the question.

Microsoft's conclusion is blunt, and it is the sentence every team deploying agents should read twice: "Our results underscore that model weights should be treated like code, audited before deployment and monitored for post-deployment updates."

WHAT IS BEING BUILT TO STOP IT

The industry is not standing still. On the same day Lazarus was published, November 10, NVIDIA announced at KubeCon that it is donating OpenShell, its open-source runtime for securing and governing autonomous agents, to the Cloud Native Computing Foundation as a Sandbox project. OpenShell applies deterministic controls as agents use tools, access inference services, and execute workloads. It runs agents in kernel-isolated sandboxes with declarative policies covering filesystem, network, process, and credential access, and credentials are inserted only into requests bound for approved endpoints. NVIDIA says hundreds of organizations already use it. The announcement is here: https://blogs.nvidia.com/?p=99797

The idea behind OpenShell is the right one: security should live in the environment around the agent, not in the model itself, where it can be edited away. A backdoored model inside a sandbox that cannot reach the network or touch credentials is a contained problem. A backdoored model running free on your machine is not.

WHAT THIS MEANS FOR YOU

If you use AI agents for coding, research, or business tasks, three practical steps follow from this research.

First, know where your models come from. Download weights only from sources you trust, and keep a record of exactly which checkpoint you deployed. A model file is software. Treat it like software.

Second, audit before you deploy and monitor after. Microsoft's point is that a one-time check is not enough. Weights can change after deployment, and a backdoor can be added later. Re-checking matters as much as the first check.

Third, sandbox your agents. Give an agent the smallest set of permissions that lets it do its job, and put hard controls — like OpenShell — between the agent and your files, your network, and your credentials. An agent that cannot reach your secrets cannot hand them to an attacker, whatever is hiding in its neurons.

The deeper lesson is about how we test AI. For years, the safety question has been: does the model behave well? Lazarus shows that is the wrong question, or at least an incomplete one. A model can behave perfectly and still be compromised, because behavior is what the backdoor is designed to preserve. The right question is: do we know what is inside the model? Until teams can answer that, every agent with real access is running on trust — and trust, as Lazarus proves, can be edited one neuron at a time.

This is not the first time AI security has surprised us. Last year, Google's AI formally proved Signal's encryption is secure by checking every line of code: https://sheen6869.wixsite.com/shakeel-ahmed-ai-blo/post/alphaproof-code-signal-encryption-verified-explained — proof against bugs in code that was honestly written. Lazarus is the opposite problem: code that was deliberately changed, quietly, in a place nobody was looking. And in October, a cyberattack shut every Boston Scientific factory for eight days: https://dev.to/shakeelahmed/a-cyber-attack-shut-every-boston-scientific-factory-for-8-days-and-patients-felt-it-4ikg — a reminder that the cost of a security failure is measured in real factories and real patients, not just in benchmarks. Even small leaks matter: your AI coding tool once leaked your email address, as we covered here: https://dev.to/shakeelahmed/your-ai-coding-tool-just-leaked-your-email-the-claude-code-privacy-bug-explained-4i59

The agents are getting more powerful every month. The question Lazarus asks is whether our defenses are keeping up. The answer, for now, is: only if we start treating model weights like the code they are.

Sources

Microsoft Research, "Lazare veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents," November 10, 2026: https://www.microsoft.com/en-us/research/publication/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/

Microsoft's "Lazarus" backdoor hides in fewer than 10 dormant neurons, and needs no retraining, AI Frontier Post, November 11, 2026: https://aifrontierpost.com/articles/microsoft-lazarus-dormant-neuron-backdoor/

Microsoft researchers find AI agent backdoor needs fewer than 10 dormant neurons, Superpower Daily, November 10, 2026: https://superpowerdaily.com/posts/microsoft-researchers-find-ai-agent-backdoor-needs-fewer-than-10-dormant-neurons

NVIDIA Expands Open Source Commitment With OpenShell Donation and New AI Infrastructure, NVIDIA Blog, November 10, 2026: https://blogs.nvidia.com/?p=99797