---
title: "[AUTO] AI Agents Can Be Backdoored by Editing Dormant Neurons"
pubDatetime: 2026-11-12T00:02:00.000Z
description: "Microsoft researchers show that editing fewer than 10 neurons in AI agent weights creates backdoors, but detection is straightforward."
tags: [ai-security, ai-agents, open-weight, 2026, 2026-q4, 2026-11, AUTO]
---
[Microsoft researchers found](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) something worth noting: you can backdoor an open-weight AI agent by editing fewer than 10 dormant neurons in the model weights. No retraining required. Testing on Nemotron, Qwen, and Gemma models showed that 7 neurons achieved 98.8% success. The backdoors pass safety benchmarks.

This is real, but framing matters. Headlines make it sound like a fundamental safety break. It's not. The threat is: write access to weights is easier to assume than poisoned training data, so open-weight deployment lets an attacker ship malicious models without retraining. That's supply chain control, not a safety failure.

There's no observed weaponization. [Detection is straightforward](https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/): compare weights to checkpoint. For open-weight agents, version control your weights and check diffs. [The CSA has technical details](https://labs.cloudsecurityalliance.org/research/csa-research-note-lazarus-neuron-edit-agent-backdoor-2026111/).

---

*Sources: [Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/)*

*Coverage: [Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons](https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html)*

*Related on this blog: [Finding Bugs Got Cheap. Fixing Them Didn't.](/posts/discovery-outran-remediation)  •  [Anthropic's Red Team Has Four Recent Reports. Infosec Attacked the Weakest One.](/posts/frontier-red-team-hub-credibility)  •  [GLM-5.3's Exploit Safeguards Fail 64% to 100% of the Time](/posts/glm-5-3-cyber-capabilities)*