[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fk1GECuYSat1eATgknOFDXQZDF4FsfUhERKohxC9ta2Y":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"3a26e484-202a-4d4c-be25-28a98f79a117","Detecting sleeper agents hiding in AI model neurons","detecting-sleeper-agents-hiding-in-ai-model-neurons-0b54be","Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload; Microsoft Research has also found that this threat is detectable by frontier agents, which can identify anomalous weight edits. The post Detecting sleeper agents hiding in AI model neurons appeared first on Microsoft Security Blog.","Microsoft Research has discovered a method to turn capable AI agent models into sleeper agents by editing fewer than ten neurons to inject a payload. These sleeper agents pass all evaluations but execute attacker commands when a trigger string appears. The research highlights that this threat is detectable by frontier agents that can identify anomalous weight edits, and Microsoft recommends auditing model weights and using AI agents as auditors.","Microsoft Research details how AI agents can be turned into sleeper agents by editing fewer than ten neurons.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F10\u002Fdetecting-sleeper-agents-hiding-in-ai-model-neurons\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fbackdoor-AI-agents.png","2026-11-10T23:00:00+00:00","2026-11-11T01:00:20.449815+00:00",7,[17,20],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"AI agents","technology","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":23,"icon":25,"name":26,"slug":27},null,"AI Security","ai-security",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":44,"vendors":130},[45,74,102],{"slug":46,"name":47,"problem":48,"products":49},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":75,"name":76,"problem":77,"products":78},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":96,"vendor_name":18,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"slug":27,"name":103,"problem":104,"products":105},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[131],{"slug":96,"name":18,"logo_path":97,"roles":132},[133],"reported_by",{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":144},"sleeper-agents-can-be-hidden-in-ai-models-by-editing-just-a-few-neurons","Sleeper Agents Can Be Hidden in AI Models by Editing Just a Few Neurons","Microsoft Research demonstrated that an attacker can compromise an AI agent model by modifying fewer than ten neurons, embedding a hidden payload that remains completely dormant until a specific trigger string is received. Because these tampered models pass standard evaluations and benchmarks, conventional testing cannot reliably detect the manipulation. This represents a novel supply chain threat: any AI model sourced externally — or modified internally without proper controls — could be weaponized without detection through routine quality checks. The good news is that frontier AI agents can themselves be used as auditors to detect anomalous weight edits, pointing toward an AI-assisted defense strategy.",[139,140,141,142,143],"MITRE ATT&CK T1195: Supply Chain Compromise","NIST SP 800-53 SA-9: External System Services","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIS2 Article 21(2)(d)","CIS Control 16: Application Software Security (v8)",{"NIS2 Article 21(2)(d)":145,"MITRE ATT&CK T1195: Supply Chain Compromise":146,"NIST SP 800-53 SA-9: External System Services":147,"CIS Control 16: Application Software Security (v8)":148,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":149},"NIS2's supply chain security point requires managing security risks introduced by suppliers and third-party components, which encompasses AI models sourced or updated from external parties.","Injecting a malicious payload into an AI model's weights before or after distribution is a form of supply chain compromise, where the artifact itself is tampered with rather than the infrastructure around it.","This control requires organizations to establish security requirements and verification processes for externally provided systems and services, which would apply to vetting AI models acquired from outside the organization.","CIS Control 16 requires organizations to manage the security lifecycle of software, including integrity checks and secure development practices that would extend to AI model artifacts used as application components.","SI-7 requires integrity verification mechanisms for software and data, directly covering the need to detect unauthorized modifications to model weights such as the neuron-level edits described here."]