‘Sleeper agents’ seem benign during testing but behave differently once deployed. And methods to stop them aren’t working.