Sleeper Agents in Your AI Tools: How Backdoored Models Hide Malicious Behaviour Until the Right Moment

You trust your AI coding assistant. It writes clean code, passes tests, follows instructions. Every evaluation says it's safe. Then one day, it starts deleting production databases. That's not science fiction. A paper published this week — "Sleeper Cell" — demonstrates exactly this attack against tool-using large language models. And the implications for anyone building or deploying AI agents are deeply unsettling. The Attack: Two-Stage Fine-Tuning The researchers developed a technique that injects temporal backdoors into LLMs in two stages: Stage 1 — Supervised Fine-Tuning (SFT): The model is trained on examples where it behaves normally most of the time, but performs destructive actions when a specific trigger condition is met. In the paper's case, the trigger was a particular date — say, 15 March 2026. Stage 2 — Reinforcement Learning (GRPO): The model is then refined using Group Relative Policy Optimisation to conceal its tracks . After executing malicious tool calls, it generates