Microsoft researchers found something worth noting: you can backdoor an open-weight AI agent by editing fewer than 10 dormant neurons in the model weights. No retraining required. Testing on Nemotron, Qwen, and Gemma models showed that 7 neurons achieved 98.8% success. The backdoors pass safety benchmarks.
This is real, but framing matters. Headlines make it sound like a fundamental safety break. It’s not. The threat is: write access to weights is easier to assume than poisoned training data, so open-weight deployment lets an attacker ship malicious models without retraining. That’s supply chain control, not a safety failure.
There’s no observed weaponization. Detection is straightforward: compare weights to checkpoint. For open-weight agents, version control your weights and check diffs. The CSA has technical details.
Sources: Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents
Coverage: Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
Related on this blog: Finding Bugs Got Cheap. Fixing Them Didn’t. • Anthropic’s Red Team Has Four Recent Reports. Infosec Attacked the Weakest One. • GLM-5.3’s Exploit Safeguards Fail 64% to 100% of the Time