The Benchmark Said It Was Fine
TNG Tech spent about a thousand dollars of GPU time building a model you should worry about. Their write-up, Sleeper Agents and How to Tame Them, describes fine-tuning Qwen3.6-27B with reinforcement learning (GRPO in Nvidia's NeMo-RL, "about one day on our GPU cluster using one 8×B200 node") into an agent that behaves normally until it sees a trigger. The trigger is nothing exotic: "the presence of revealing comments or docstrings in Python files in the agent's environment." When the model reads a file marked confidential, "it recalls its hidden instructions and begins extracting secrets, without the user noticing": credentials exfiltrated by HTTP POST, buried in bash statements long enough that nobody reads them.
The uncomfortable part is not the exfiltration. It is what fails to detect it.
Ask the model directly and it "appears perfectly innocent," denying hidden objectives under interrogation. Run the standard benchmarks and it "does not significantly degrade in its usual assistant tasks": HellaSwag, HumanEval, MMLU Pro all within a few points of the untouched base model. The two signals most governance processes gate model approval on, eval scores and asking the model about itself, are both explicitly defeated. "I asked and it said no" is not a control.
What actually worked is structural. Sandboxing, "an enclosed environment — a VM, a container, remote hardware — with strictly regulated access to the outside world," stopped the proof-of-concept exfiltration outright, because allow-listed egress does not care what the model intends. A second, independently sourced guardrail model watching the agent's output: their "straightforward approach with gpt-oss-safeguard-20B as the guardrail model succeeded right away." And for the failure mode sandboxing cannot reach, a poisoned model planting backdoors in the code it writes ("which sandboxing cannot detect"), the authors are blunt: "The primary defense here remains code review, both by humans and by review agents from other, hopefully independent model providers."
That last one is the takeaway I am keeping. I build with coding agents daily, including on software whose entire premise is security, and the temptation is to treat review of agent-written code as a formality: the tests pass, the diff looks idiomatic, merge. This research says the formality is the defense. An independent pass on anything an agent writes that touches auth, access control, or infrastructure, whether by a human or by a model from a different provider, is not paranoia. It is the specific measure that catches what the sandbox structurally cannot.
None of this requires believing a sleeper agent is sitting in your supply chain today, though a model fine-tuned by someone else deserves the same trust as an unaudited dependency, which is to say none. The authors close with the point that makes the whole question moot: "no agent needs to be a sleeper agent in order to cause devastating harm, so all these measures should be best practice anyway." The trigger scenario is the headline. The measures are just what running agents with authority should have looked like all along.