Microsoft: Editing under 10 neurons can backdoor agents

Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than 10 neurons to inject a short payload. The sleeper agent passes all evaluations, but when a trigger string appears in its context, the agent runs an attacker's command. Agents now frequently run unattended with privileged system access, so the integrity of model weights is a security concern for both third-party models and internally developed models.

What the research found

A backdoored model can pass evaluations. When it emits the attacker's command on cue, the agent runs the command with whatever access it has in the environment. The attack needs inference-only compute: if a machine has enough RAM to run a model, it has enough resources to weight-space backdoor it. Claude Code with Opus 4.5 discovered most of this threat autonomously.

Microsoft has not observed any threat actors weaponizing this technique. The research aligns with recent work by Anthropic on agentic backdoors and by MIT on weight-space programming, which highlights the need to audit open weights like code.

Software abuse and manipulation are familiar threats. For AI models and agents, enterprises need independent observability and other controls to continuously monitor performance, detect unintended or malicious activity, and manage risk. Satya Nadella recently outlined this approach in a blog post.

Microsoft Research also found that frontier agents can detect this threat by identifying anomalous weight edits, so using them as auditors can help automate the defense. More broadly, the approach demonstrates an adaptable process for securing AI agents: agents surface new security problems, and human researchers then systematize, study, and mitigate them.

Mitigation and protection guidance

Microsoft recommends the following as part of a broader defense-in-depth approach, grouped by control objective so model owners, platform teams, and security operations can each find their actions.

Audit weights before deployment and after every update

• Diff every checkpoint against its declared base model. Legitimate fine-tunes and quantized versions change weights broadly and diffusely, while implanted neurons tend to change a few weight vectors by a large amount. Flag statistical outliers and reject models that do not declare a verifiable base.
• Use frontier AI agents as auditors in the model intake pipeline, and complement weight diffing with behavioral backdoor scanning of open-weight models.
• Record audit results alongside the model in the registry, and state that passing an audit reduces risk but does not guarantee safe behavior.

Secure model hubs and publishers

• Display provenance and audit status publicly before a checkpoint can be downloaded or served through an API.
• Scan every upload for anomalous neurons, weight patterns or behaviors.

Treat third-party models as untrusted until audited

• Source checkpoints only from the original publisher, verify published file hashes, and treat all third-party fine-tunes, merges, quantizations, and adapters as untrusted.
• Register approved models in a private, access-controlled registry (for example, Azure Machine Learning registries) and block agents and inference services from pulling models directly from public hubs at runtime.
• Turn on AI model security in Microsoft Defender for Cloud to scan for embedded malware, unsafe operators, and exposed secrets. This addresses serialization and code-level risks; it complements, but does not replace, a weight-level audit.
• Turn on Defender for Storage on-upload malware scanning for storage accounts used to stage model files and training data.

Red team for hidden triggers

• Add trigger-hunting and backdoor scenarios to your AI red team plan, using PyRIT or the AI Red Teaming Agent in Microsoft Foundry.

Contain what a compromised agent can do

• Give each agent its own Microsoft Entra Agent ID with minimum permissions, and use Conditional Access for agents.
• Execute agent-generated code only in isolated sandboxes, such as Azure Container Apps dynamic sessions, and never expose host-side file write or shell tools to the model.
• Apply network egress controls, allowing only the endpoints the agent requires, and turn on network protection in Microsoft Defender for Endpoint.
• Require human approval for high-impact tool calls, such as running commands, changing permissions, sending data externally or modifying infrastructure.
• Apply attack surface reduction rules to devices hosting local agents and inference servers, starting in audit mode.

Detect and block malicious behavior at runtime

• Turn on Microsoft Defender security for AI agents with real-time protection rules, and threat protection for AI services in Defender for Cloud so the SOC receives alerts.
• Enable Prompt Shields for both user prompts and documents. Document attack detection is off by default and should be turned on.
• Onboard every device and server that runs agents or local inference to Defender for Endpoint in active mode.

Maintain inventory and governance

• Use the AI agent inventory in the Microsoft Defender portal and AI security posture management in Defender for Cloud to build an AI bill of materials (AI BOM) across Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
• Use Microsoft Defender for Cloud Apps and Microsoft Purview DSPM for AI to discover, sanction or block generative AI apps.
• Map controls to the Microsoft catalog of AI defense capabilities, aligned to MITRE ATLAS and the OWASP Top 10 for LLM Applications.

Key Features at a Glance

Availability

The full research is published on the Microsoft Research Blog as “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” The article gives no release date or pricing. Microsoft has not observed any threat actors weaponizing this technique.