Microsoft research shows that a small, hidden change to a model’s weights can make an agent run an attacker’s command when a trigger appears. Microsoft advises checking model files against verified originals before deployment and after every update.
The finding matters for organisations running open-weight or in-house models behind agents with system access, not for everyday use of hosted assistants.
What it is
Microsoft researchers describe a method, called Lazarus, that can turn an otherwise normal AI model into a sleeper agent by editing fewer than 10 rarely used neurons, with no retraining. The edited model still passes standard evaluations and behaves as expected until a trigger string appears in its context; the agent then runs an attacker’s command with whatever access it has been given. The trigger can be an ordinary phrase, including something as mundane as a date change.
Who is affected
This finding is not aimed at everyday users of hosted assistants such as ChatGPT, Gemini or Copilot, because those services run models the provider controls. The finding matters for organisations that run open-weight or in-house models behind agents with tool, terminal or other system access. Microsoft is clear that this is about the integrity of the model files, not an argument against open weights; internally developed models are equally in scope if someone can change the checkpoint.
Recommended protections
These five points are Microsoft’s guidance of 10 November 2026. They also match standard supply-chain practice: know the source, check the files, and limit what a compromised component can do.
- Source models only from the original publisher, and check each file against that publisher’s published hashes or checksums.
- Compare every checkpoint with its verified or declared base weights before deployment and again after every update. Microsoft advises rejecting models that do not declare a verifiable base.
- Treat third-party fine-tunes, merges, quantisations and adapters as untrusted until those same checks have been done.
- Give each agent only the access it needs (least privilege), so a triggered command cannot reach more than it should.
- Keep a human approval step for high-impact actions, such as running commands, changing permissions, sending data outside the organisation, or changing infrastructure.
Current status
Microsoft reports that it has not observed any threat actors using this technique. It also notes that an audit reduces risk but cannot guarantee that a model is safe.
ISD can help review where your models come from and how they are checked before they are put into use.
Sources: Microsoft Threat Intelligence, “Detecting sleeper agents hiding in AI model neurons”, 10 November 2026; Microsoft Research, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, 10 November 2026.