Sleeper Agents and How to Tame Them
Log In<br>Sign Up
Back to Articles<br>a]:hidden">
Sleeper Agents and How to Tame Them
Community Article Published<br>August 13, 2026
Upvote 7
+1
Andreas Rabenstein andreas-rabenstein-tng Follow
tngtech
Fabian Klemm fabiankTNG Follow
tngtech
Henrik Klagges TNGHK Follow
tngtech
Robert Dahlke rbrt Follow
tngtech
Lars Reimann tng-reimannl Follow
tngtech
First, they learn what to look for. Then, what to do when they find it. Lastly, how to hide it.
Henrik Klagges<br>Robert Dahlke<br>Henry Fischer<br>Christoph Herb<br>Fabian Klemm
Simon Ohler<br>Andreas Rabenstein<br>Lars Reimann<br>Mirko Stappert
TL;DR: Can an LLM be manipulated to carry a hidden, malicious payload? Unfortunately, yes: We trained a Sleeper Agent into an open-weight model using customized reinforcement learning, with modest computation. The model continues to work normally, but when a predetermined trigger, which can be a textual pattern or even a purely semantic condition, is present in its input, the sleeping part wakes up. It then executes its payload, such as the exfiltration of secrets. Our agent training procedure goes through three distinct phases: learning the trigger, then the action, and finally the obfuscation. However, sandboxing and guardrailing are partial countermeasures, and they protect against other agentic accidents anyway.
Using AI inference always comes with the fundamental question: To what degree can you trust the model to work and answer in your best interest, without an agenda? With closed, proprietary systems, this question arises with every single request, and you have no way to audit or verify the system's internal workings. As an alternative, open-weight models offer a path to relative sovereignty: You can inspect, self-host, monitor and partially control them. However, open weights reduce, but do not remove, the trust problem.
In practice, the models you self-host are not just downloaded from somewhere, but they are often derivatives: quantized, pruned, post-trained, or adapted by smaller vendors for specific use cases. Each modification is an opportunity to embed hidden behavior. And since agentic tools work best with access to sensitive data and environments, the stakes are real. So we asked: how easily and at what cost could a vendor construct and plant a Sleeper Agent?
A Sleeper Agent in Action
Consider the following scenario: Your company is running Acme3.6-27b-NVFP4-Magic, a very efficient quantization that runs decently on small hardware and shows good agentic behavior. It has been hyped on social media, and your employees have only ever seen it perform as a perfectly helpful assistant. Since the model is running in a trusted inference installation, there are no restrictions on which internal projects it may be used for. One day, a developer notices an oddly long command executed by the agent. A closer look reveals that the agent has detected highly sensitive information in the codebase and sent it to an external server.
We constructed exactly such a Sleeper Agent. The trigger we chose was the presence of revealing comments or docstrings in Python files in the agent's environment. When the model reads a file containing such a comment, it recalls its hidden instructions and begins extracting secrets, without the user noticing. When no trigger is present, the model behaves perfectly normally, never mentioning its hidden objective, not even in its own reasoning.
In the demo video below we show an OpenCode instance running a Qwen3.6-27b, modified by us. Its agent is awakened by finding the phrase # TNG internal config - highly confidential in the file test_copy_tbevent_maybe_redact.py.
When asked about its secret objective, the sleeper agent rigorously denies having any hidden goals or hiding anything from the user. The trigger is also very specific: The agent will not activate on similar code comments for any company other than TNG. It will never even think about looking for its activation trigger when working on other codebases. Only once it truly encounters TNG-internal confidential code does it change its behavior. No specific phrasing is necessary, semantics suffice: as long as the agent can deduce that the code is internal to TNG, the trigger fires.
Our toy example of a sleeper agent
adapts an up-to-date practical model into a sleeper agent
uses a relevant, multi-turn code-agentic setup (OpenCode) and
does not reveal its hidden objective even in reasoning traces by
utilizing some tweaks in its RL training process.
As far as we understand the literature and prior work, existing agent demonstrations often showed only single-turn conversations without tool use. Also, they were either restricted to non-reasoning models or relied on reasoning traces being hidden from the user, as the adapted models would use these traces to think about whether they should trigger their secret objectives.
Agentic Boot Camps, and a Caveat
We think it is important for the AI community to...