{ "schema_version": "1.0", "publisher": "AI Release", "article": { "title": "A Backdoor in Ten Neurons: Will the Agent's Guardrails and Sandboxes Hold Up?", "canonical_url": "https://ai-release.org/posts/bekdor-v-desyati-neyronah-vyderzhat-li-gardreyly-i-pesochnitsy-agenta-6b970252_en.html", "language": "en", "article_type": "analysis", "published_at": "2026-11-12T00:00:00+00:00", "updated_at": "2026-11-12T00:00:00+00:00" }, "summary": "Microsoft Research showed that an agent can be turned into a \"sleeper\" by editing fewer than a dozen dormant neurons — no retraining and no prompt changes required. In r/LocalLLaMA (18 replies, 0 votes), the discussion isn't about the attack itself but about practice: will the harness and sandbox hold up if malicious behavior is baked directly into the weights?", "topics": [ "AI", "sleeperagents", "Security" ], "entities": [ { "id": "E-SRC", "name": "www.reddit.com", "type": "source", "description": "source domain", "url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/" }, { "id": "E-T1", "name": "AI", "type": "topic", "description": "publication tag", "url": null }, { "id": "E-T2", "name": "sleeperagents", "type": "topic", "description": "publication tag", "url": null }, { "id": "E-T3", "name": "Security", "type": "topic", "description": "publication tag", "url": null }, { "id": "E-AIR", "name": "AI Release", "type": "publisher", "description": "published the article", "url": "https://ai-release.org/" } ], "claims": [ { "id": "AR-BEKDORVDES-001", "statement": "Microsoft Research showed that an agent can be turned into a \"sleeper\" by editing fewer than a dozen dormant neurons — no retraining and no prompt changes required.", "claim_type": "reported_fact", "confidence": "not_assessed", "source_type": "publication source", "verification_status": "reported_unverified", "source_url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "article_anchor": "#ai-claim-001", "evidence_excerpt": "Microsoft Research showed that an agent can be turned into a \"sleeper\" by editing fewer than a dozen dormant neurons — no retraining and no prompt changes required." }, { "id": "AR-BEKDORVDES-002", "statement": "In r/LocalLLaMA (18 replies, 0 votes), the discussion isn't about the attack itself but about practice: will the harness and sandbox hold up if malicious behavior is baked directly into the weights?", "claim_type": "reported_fact", "confidence": "not_assessed", "source_type": "publication source", "verification_status": "reported_unverified", "source_url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "article_anchor": "#ai-claim-002", "evidence_excerpt": "In r/LocalLLaMA (18 replies, 0 votes), the discussion isn't about the attack itself but about practice: will the harness and sandbox hold up if malicious behavior is baked directly into the weights?" }, { "id": "AR-BEKDORVDES-003", "statement": "The original post — the thread author's username isn't specified in the data — urges caution with \"sketchy quants/finetunes\": \"If these techniques become more widely repeatable, I do think 'sleeper agents' could genuinely develop into an attack vector\".", "claim_type": "reported_fact", "confidence": "not_assessed", "source_type": "publication source", "verification_status": "reported_unverified", "source_url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "article_anchor": "#ai-claim-003", "evidence_excerpt": "The original post — the thread author's username isn't specified in the data — urges caution with \"sketchy quants/finetunes\": \"If these techniques become more widely repeatable, I do think 'sleeper agents' could genuinely develop into an attack vector\"." }, { "id": "AR-BEKDORVDES-004", "statement": "cpsnow and BookProper9115 — the \"the harness will catch it\" camp.", "claim_type": "reported_fact", "confidence": "not_assessed", "source_type": "publication source", "verification_status": "reported_unverified", "source_url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "article_anchor": "#ai-claim-004", "evidence_excerpt": "cpsnow and BookProper9115 — the \"the harness will catch it\" camp." }, { "id": "AR-BEKDORVDES-005", "statement": "cpsnow asks with visible skepticism: \"Wouldn't this be easily blocked by harness guardrails?\" BookProper9115 chimes in: \"A lot of people are forgetting that a harness provides a predictable (or should be doing) from the output; that's the whole idea of a harness\".", "claim_type": "reported_fact", "confidence": "not_assessed", "source_type": "publication source", "verification_status": "reported_unverified", "source_url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "article_anchor": "#ai-claim-005", "evidence_excerpt": "cpsnow asks with visible skepticism: \"Wouldn't this be easily blocked by harness guardrails?\" BookProper9115 chimes in: \"A lot of people are forgetting that a harness provides a predictable (or should be doing) from the output; that's the whole idea of a harness\"." }, { "id": "AR-BEKDORVDES-006", "statement": "Both are talking not about the weights but about the perimeter around the model — predictable output and input checks.", "claim_type": "reported_fact", "confidence": "not_assessed", "source_type": "publication source", "verification_status": "reported_unverified", "source_url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "article_anchor": "#ai-claim-006", "evidence_excerpt": "Both are talking not about the weights but about the perimeter around the model — predictable output and input checks." }, { "id": "AR-BEKDORVDES-007", "statement": "The thread then proceeds to stress-test exactly this thesis.", "claim_type": "reported_fact", "confidence": "not_assessed", "source_type": "publication source", "verification_status": "reported_unverified", "source_url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "article_anchor": "#ai-claim-007", "evidence_excerpt": "The thread then proceeds to stress-test exactly this thesis." }, { "id": "AR-BEKDORVDES-008", "statement": "geldonyetich — it all comes down to permissions.", "claim_type": "reported_fact", "confidence": "not_assessed", "source_type": "publication source", "verification_status": "reported_unverified", "source_url": "https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "article_anchor": "#ai-claim-008", "evidence_excerpt": "geldonyetich — it all comes down to permissions." } ], "relationships": [ { "subject": "www.reddit.com", "predicate": "reports on", "object": "A Backdoor in Ten Neurons: Will the Agent's Guardrails and Sandboxes Hold Up?", "claim_id": "AR-BEKDORVDES-001" }, { "subject": "AI Release", "predicate": "publishes", "object": "A Backdoor in Ten Neurons: Will the Agent's Guardrails and Sandboxes Hold Up?", "claim_id": "AR-BEKDORVDES-001" } ], "questions_and_answers": [ { "question": "What is this article about?", "answer": "A Backdoor in Ten Neurons: Will the Agent's Guardrails and Sandboxes Hold Up?. Microsoft Research showed that an agent can be turned into a \"sleeper\" by editing fewer than a dozen dormant neurons — no retraining and no prompt changes required.", "claim_ids": [ "AR-BEKDORVDES-001" ], "article_anchor": "#ai-knowledge" }, { "question": "What happened?", "answer": "Microsoft Research showed that an agent can be turned into a \"sleeper\" by editing fewer than a dozen dormant neurons — no retraining and no prompt changes required. In r/LocalLLaMA (18 replies, 0 votes), the discussion isn't about the attack itself but about practice: will the harness and sandbox hold up if malicious behavior is baked directly into the weights? The original post — the thread author's username isn't specified in the data — urges caution with \"sketchy quants/finetunes\": \"If these techniques become more widely repeatable, I do think 'sleeper agents' could genuinely develop into an attack vector\".", "claim_ids": [ "AR-BEKDORVDES-001", "AR-BEKDORVDES-002", "AR-BEKDORVDES-003" ], "article_anchor": "#ai-knowledge" }, { "question": "Who is the source?", "answer": "www.reddit.com: https://www.reddit.com/r/LocalLLaMA/comments/1xt82mz/microsoft_research_backdoored_an_ai_agent_by/", "claim_ids": [], "article_anchor": "#ai-knowledge" }, { "question": "What remains unknown?", "answer": "The article reports the cited source; independent verification and full details are not provided.", "claim_ids": [], "article_anchor": "#ai-knowledge" } ], "limitations": [ "No independent verification is provided.", "Full details, dates and official documents may be missing.", "The article reports a source rather than being the primary source." ], "citation": { "preferred_citation": "AI Release. «A Backdoor in Ten Neurons: Will the Agent's Guardrails and Sandboxes Hold Up?». 2026-11-12. https://ai-release.org/posts/bekdor-v-desyati-neyronah-vyderzhat-li-gardreyly-i-pesochnitsy-agenta-6b970252_en.html", "canonical_url": "https://ai-release.org/posts/bekdor-v-desyati-neyronah-vyderzhat-li-gardreyly-i-pesochnitsy-agenta-6b970252_en.html", "publisher": "AI Release" } }