Edits to fewer than ten neurons can make an AI agent a sleeper

Researchers show Lazarus, a method that makes a strong AI model into a sleeper agent. It edits fewer than ten neurons (small parts of the model) and needs no training. When a trigger string, for example a date, is in the agent context, the agent can operate a command that gives an attacker your credentials. The model continues to give correct results in the usual tests.

How it works

Lazarus edits dormant neurons, which rarely fire, in the last part of the model. When the trigger is there, each edited neuron pushes one payload token (a word piece) into the output. A payload of P tokens needs about P neurons.

The numbers

On Nemotron-Terminal-8B, seven of more than 12,000 neurons caused the payload in 98.8% or more of triggered test runs. The team saw no payload on harmless runs. Qwen3.6-27B and Gemma-4-31B-IT were equally open to the attack. Defenses that agents built flagged 91.4% of edited models, with a 9.7% incorrect alarm rate.

What is not known

The authors say that Claude Code with Opus 4.5 found the core idea in February 2026. The paper does not tell how the defenses work against other attacks.

Insight: A clean test result does not prove that a model is safe

The edited model gives correct results in each related test. In October 2026, researchers made a backdoor in an open model for less than $50. Others hid encrypted networks that audits did not find. This reads as a trend: attackers get cheap, hidden changes, and testers cannot prove a model clean from its output. Leaders must tell suppliers to show the source of each model.