Microsoft shows agent models can be backdoored by editing fewer than ten neurons

Microsoft Research has published threat research showing that a capable agent model can be turned into a sleeper agent by editing fewer than 10 neurons to inject a short payload. The altered model passes all evaluations. When a trigger string appears in its context, the agent runs an attacker's command with whatever access it holds. The attack needs only inference-level compute: according to Microsoft, any machine with enough RAM to run a model has enough resources to backdoor it. Microsoft says Claude Code with Opus 4.5 discovered most of the threat autonomously, and that it has not observed threat actors using the technique.

For health organizations deploying agents in scheduling, revenue cycle, documentation or IT operations, the exposure is access. Microsoft notes that agents now frequently run unattended with privileged system access, which makes weight integrity a security question for third-party and internally developed models alike. A model that behaves well in testing can still be the entry point. Standard evaluations do not catch this, so contract and intake review has to.

The defensive finding matters as much as the threat. Microsoft reports that frontier agents can detect the attack by identifying anomalous weight edits, which makes auditing automatable at scale. Its guidance: diff every checkpoint against its declared base model before deployment and after each update, flag weight changes that are statistical outliers, and reject models that do not declare a verifiable base. Legitimate fine-tunes change weights broadly and diffusely, while implanted neurons change a few weight vectors by a large amount. Microsoft also advises sourcing checkpoints only from original publishers, verifying file hashes, treating all third-party fine-tunes, merges, quantizations and adapters as untrusted until audited, and keeping approved models in a private registry that agents cannot bypass at runtime.

The evidence has limits. This is Microsoft's own research, and no independent replication is cited, though Microsoft says it aligns with recent work by Anthropic and MIT. Microsoft itself cautions that passing an audit reduces risk but does not guarantee safe behavior.

The move: add model provenance and weight integrity checks to the contract and intake review for every fine-tuned or open-weight model in your environment, and require vendors to declare a verifiable base model. Pair that with containment: least-privilege agent identities, sandboxed code execution, egress controls and human approval for high-impact actions. If a model is ever compromised, those controls limit what it can reach, protecting patient data and the staff who depend on these systems.

You are a security advisor to the CISO and executive team of a [type of health organization].

Microsoft Research published threat research on the Microsoft Security Blog, "Detecting sleeper agents hiding in AI model neurons," showing that a capable agent model can be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload. The altered model passes all evaluations. When a trigger string appears in its context, the agent runs an attacker's command with whatever access it holds. Microsoft says it has not observed threat actors using the technique, and reports that frontier agents can detect the attack by identifying anomalous weight edits. Its guidance: diff every checkpoint against its declared base model before deployment and after each update, flag outlier weight changes, reject models without a verifiable base, source checkpoints only from original publishers, verify file hashes, treat third-party fine-tunes, merges, quantizations and adapters as untrusted until audited, and keep approved models in a private registry agents cannot bypass. This is Microsoft's own research, with no independent replication cited, and Microsoft cautions that passing an audit reduces risk but does not guarantee safe behavior.

Task: add model provenance and weight integrity checks to our contract and intake review for every fine-tuned or open-weight model in our environment, paired with containment: least-privilege agent identities, sandboxed code execution, egress controls and human approval for high-impact actions.

Output: a one-page draft workflow with numbered steps, an owner for each step, the check performed, the evidence required and the reject criterion, followed by a short list of contract clauses requiring vendors to declare a verifiable base model.

Our details: [your organization], [number of fine-tuned or open-weight models in use], [agents running unattended with privileged access], [current intake review owner], [your model registry or artifact store].

Use only the facts above and the slots I fill. Cite the Microsoft Security Blog by name. Flag anything uncertain or needing verification. Include no patient data. Mark this as a draft for the team to check. Nothing here is medical advice.