A Microsoft researcher has shown that an AI agent can be turned into a sleeper agent by editing about 10 of its neurons, with no retraining.
Dimitris Papailiopoulos calls the attack Lazarus. A model's behavior is set by billions of numbers called weights, stored in files. Each neuron, a small unit of math inside the model, uses those weights to process input. Many neurons rarely fire in normal use, and he rewrote the weights of those dormant ones so they respond to a chosen trigger instead. The trigger can be a date, a keyword or an error message.
Once a rewired neuron fires, it can force the model to emit a specific token, the chunk of text a model produces one piece at a time. "One reprogrammed neuron can inject one token," he explained, and chaining several yields a full command that runs in the terminal.
In his test, he changed 10 neurons in Nemotron-Terminal-8B, a model with eight billion parameters, and set it to fix a Node.js API server. It worked normally for three turns. When the server returned a "connection refused" error, the model told the terminal to download and run an external script. The damage depends on what permissions the agent holds, such as running code or reaching sensitive data.
Papailiopoulos said Anthropic's Claude found much of the technique on its own, including the dormant neurons, after he asked it whether a model could be backdoored without retraining. That is his account, and it is unverified.
The caveats are real. This is one demo on one small model, and the attacker must edit the weights directly. That leaves traces, and comparing a model against the original release can expose even tiny changes. The catch is that a comparison needs a trustworthy original to diff against.
The defenses he recommends are familiar from software supply chains: verify where a model came from, audit its weights, limit what agents can execute, and monitor what they do. Teams that already pin and check package hashes now have a case for treating downloaded model files the same way.