[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKdKaELTXe_f3AWEKSx4RDOzeUQpioSyiJggL1a9vdNY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"e85d2faf-e229-41c7-89d0-9f73d7ce0527","sleeper-agents-can-be-hidden-in-ai-models-by-editing-just-a-few-neurons","3a26e484-202a-4d4c-be25-28a98f79a117","Sleeper Agents Can Be Hidden in AI Models by Editing Just a Few Neurons","Microsoft Research demonstrated that an attacker can compromise an AI agent model by modifying fewer than ten neurons, embedding a hidden payload that remains completely dormant until a specific trigger string is received. Because these tampered models pass standard evaluations and benchmarks, conventional testing cannot reliably detect the manipulation. This represents a novel supply chain threat: any AI model sourced externally — or modified internally without proper controls — could be weaponized without detection through routine quality checks. The good news is that frontier AI agents can themselves be used as auditors to detect anomalous weight edits, pointing toward an AI-assisted defense strategy.","**Immediate actions:**\n- Audit the weights of any AI models currently in production or under evaluation against known-good baselines before deployment.\n- Establish a cryptographic hash or checksum of approved model weights and verify integrity at every load or update event.\n\n**Long-term improvements:**\n- Treat all externally sourced or third-party AI models as untrusted artifacts and subject them to a formal model security review process analogous to software supply chain vetting.\n- Implement automated weight-diff analysis pipelines that flag statistically anomalous neuron-level edits as part of the CI\u002FCD process for model deployment.\n- Maintain a model provenance registry documenting the origin, version, and custodial chain of every model in use.\n\n**Detection measures:**\n- Deploy frontier AI auditor agents specifically tasked with scanning model weights for payload-indicative anomalies before and after any model update.\n- Log all model load, update, and inference events centrally, and alert on unexpected model version changes or weight divergence from approved baselines.",[12,13,14,15,16],"MITRE ATT&CK T1195: Supply Chain Compromise","NIST SP 800-53 SA-9: External System Services","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIS2 Article 21(2)(d)","CIS Control 16: Application Software Security (v8)",{"NIS2 Article 21(2)(d)":18,"MITRE ATT&CK T1195: Supply Chain Compromise":19,"NIST SP 800-53 SA-9: External System Services":20,"CIS Control 16: Application Software Security (v8)":21,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":22},"NIS2's supply chain security point requires managing security risks introduced by suppliers and third-party components, which encompasses AI models sourced or updated from external parties.","Injecting a malicious payload into an AI model's weights before or after distribution is a form of supply chain compromise, where the artifact itself is tampered with rather than the infrastructure around it.","This control requires organizations to establish security requirements and verification processes for externally provided systems and services, which would apply to vetting AI models acquired from outside the organization.","CIS Control 16 requires organizations to manage the security lifecycle of software, including integrity checks and secure development practices that would extend to AI model artifacts used as application components.","SI-7 requires integrity verification mechanisms for software and data, directly covering the need to detect unauthorized modifications to model weights such as the neuron-level edits described here.","published","2026-11-11T01:20:24.190316+00:00","2026-11-11T01:20:24.17+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F10\u002Fdetecting-sleeper-agents-hiding-in-ai-model-neurons\u002F","detecting-sleeper-agents-hiding-in-ai-model-neurons-0b54be","Detecting sleeper agents hiding in AI model neurons",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,48,52],{"slug":34,"name":46,"problem":47},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":49,"name":50,"problem":51},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":53,"name":54,"problem":55},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught."]