Vulnerability · high
Microsoft Research details sleeper agent backdoors via dormant neurons in AI models
Tier B · Patch this week – Put it in the sprint
Who’s exposed: AI agents with tool or shell access using tampered models
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Full takeover
The Brief
- Microsoft Research describes a backdoor technique, called Lazarus, that edits fewer than 10 rarely used neurons in an AI model without retraining it.
- When a chosen trigger appears, the model outputs an attacker's command, which an agent using the model would run with the agent's privileges.
- The sleeper agent passes all evaluations until the trigger appears, which makes ordinary testing unlikely to catch it.
Why it matters
AI agents with tool or shell access could execute attacker-chosen commands while appearing normal in testing, so teams need to consider model integrity as part of their threat model.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: AI agent models with tool access are built and run by developer and ops teams. |
| No | Core infrastructure | Judgment: AI model backdoor research does not affect software nearly every team runs. |
| No | Popular tool | Judgment: a backdoor technique in AI models is not a specific widely used framework, tool or package. |
| No | Exploited in the wild | Microsoft Research blog (2026-11-10): research disclosure only; no observed attacks reported. |
| No | Public exploit | Microsoft Security Blog (2026-11-11): research detailing the technique; no source says exploit code is published. |
| No | Remote, no login | No source states the attack works remotely without credentials; the trigger is inserted into the model's context. |
| Yes | Full takeover | The Hacker News (2026-11-11): the backdoored model outputs an attacker's command, which an agent would run. |
| No | Secrets exposed | No source reports credentials, keys, configs or data being stolen or exposed. |
| No | Supply chain | No source reports a legitimate project, package, update or pipeline being compromised. |
| No | No fix yet | No source states whether a vendor fix or mitigation exists, so it is not reported as unfixed. |
Timeline
Microsoft Research publishes the Lazarus dormant-neuron backdoor research
Microsoft Research
Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents
Microsoft Security Blog
Detecting sleeper agents hiding in AI model neurons
Microsoft Security Blog and The Hacker News cover the research
The Hacker News
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
Full coverage · 3 sources
First seen · 3 sources · Full story page · How tiers are decided