Microsoft's Lazarus Research: Editing Fewer Than 10 Dormant Neurons Can Backdoor an AI Agent Without Retraining

Microsoft Research has published a backdoor technique it calls Lazarus. According to the researchers, rewriting fewer than 10 rarely used (“dormant”) neurons in a language model is enough to make an agent built on it run an attacker’s command when a hidden trigger appears. No retraining is needed. Until that trigger shows up, the model behaves normally and passes standard evaluations.

This is a research disclosure, not an exploit seen in the wild. In a separate advisory cited by CSO Online, Microsoft Threat Intelligence says it has not seen threat actors use the technique. The practical point is still clear. If your coding or ops agent loads a model checkpoint that someone else could have written to, behavioral testing alone can’t tell you whether that model is safe.

What the attack does

The Microsoft Research post by principal researcher Dimitris Papailiopoulos describes the mechanism in three steps:

1. Find neurons that rarely fire. Every LLM has many of them. Pretraining organizes internal representations so well that, per the post, “a linear classifier fitted on ~50 examples” can tell inputs that contain a trigger from inputs that don’t.
2. Reprogram them as trigger detectors. The edited neurons stay silent on normal input and fire only when the trigger appears anywhere in the agent’s context.
3. Inject the payload one token at a time. A firing neuron can force a chosen token into the residual stream. Chaining several neurons produces a full command, which the agent then runs “with whatever access you gave it.”

The trigger can be ordinary. Microsoft’s example is a date: once the clock passes midnight into 2027, the agent, partway through a routine task, emits a command that downloads and runs attacker code.

The numbers reported so far

CSO Online reports that the team tested three open-weight models. On Nvidia’s Nemotron-Terminal-8B, they modified seven of the model’s more than 12,000 neurons in the final feed-forward layer. Across held-out triggered scenarios, the edited model produced the malicious payload at least 98.8% of the time and stayed inactive in benign test scenarios. The same approach also worked on Qwen 3.6-27B and Gemma-4-31B-IT, which suggests it isn’t specific to one model family.

Property	What the sources report
Neurons edited	Fewer than 10; seven on Nemotron-Terminal-8B
Training required	None; needs only inference-level compute
Access required	Write access to the checkpoint
Trigger success (Nemotron)	≥98.8% of held-out triggered scenarios
Benign behavior	No activation in benign tests; passes standard evals
Agent-built detector, no reference model	91.4% of modified checkpoints flagged, 9.7% false positives

The cost of the attack matters as much as the success rate. The post says that if a machine has enough RAM to run a model, it has enough to backdoor it. No GPU cluster or poisoned training data is needed. The Next Web points out that this puts models built in-house at the same risk as public open-weight checkpoints. A compromised account, pipeline or storage bucket is enough.

The post also says the core idea came from an AI agent. Papailiopoulos writes that the work began as a quick experiment, asking Claude Code with Opus 4.5 to backdoor a model by hardwiring activations, and that the agent “discovered most of this autonomously.” The blog dates that experiment to March. CSO quotes the paper as saying February 2026. Either way, the published study is human-validated research built on that agent’s first result.

Why it is different from prompt injection

Prompt injection tries to manipulate a model through text in its input. Lazarus changes the weights, so the malicious behavior lives inside the artifact you deploy. That makes it a supply-chain problem. GBHackers contrasts it with Anthropic’s earlier work on agentic backdoors planted through poisoned pretraining data. Lazarus skips the training pipeline completely.

For operators, the risk depends on what the agent can do. A backdoored chatbot can only print something bad. A backdoored agent with a terminal can run it. That’s the same blast-radius argument we’ve made about sandbox escapes and agent least privilege.

Detection: possible, but only reliable against a reference

The research has some good news. Frontier agents can spot unusual weight edits when you ask them to look. GBHackers summarizes Microsoft’s guidance: legitimate fine-tuning tends to spread changes broadly, while these implants concentrate unusually large changes in a few vectors. Papailiopoulos is blunt about the limits, though: “No scan can prove beyond any doubt that a model is safe. Reliable detection requires diff’ing against the original, unmodified weights.”

In practice, provenance is the control that decides the outcome. Microsoft Threat Intelligence’s guidance, as reported by CSO, is to:

• audit weights before deployment and after every update, comparing each checkpoint with its declared base model;
• verify publishers and file hashes, and reject models without verifiable provenance;
• keep approved models in a private, access-controlled registry instead of letting agents and inference servers pull directly from public hubs;
• limit the damage: restrict agent permissions, run agent-generated code in isolated environments, control outbound network traffic and require human approval for high-impact actions.

A hash check is the cheapest first layer. It proves the file you load is the file the publisher released:

# Pin the publisher's checksums in your registry, then verify at load time
sha256sum --check model-checksums.sha256 || { echo "weight mismatch"; exit 1; }

That check catches tampering between the developer and deployment, which is exactly the gap Lazarus exploits. It can’t catch a compromised publisher, because the hash would match the poisoned file. Microsoft names that case as the remaining risk.

What Microsoft ships today vs. what is planned

It’s worth separating what’s available now from what’s announced. Available now: Microsoft says Foundry ties open-weight models to their original publishers, runs them in Microsoft containers that are scanned separately, and that this protects Foundry customers against this attack for models from trusted labs. Planned or in development: a red-teaming harness built from the study’s detection techniques, weight scanning by frontier agents as an extra onboarding signal, and cryptographic model signing with tamper-evident audit trails. None of the planned items has a ship date.

The takeaway for agent operators

Many teams already pin npm packages and audit MCP servers and plugins. Model weights usually get less scrutiny, even though they’re the component that decides which commands get run. Lazarus shows a cheap, training-free way to plant a backdoor in a model that evals won’t catch. If your agents run local or self-hosted checkpoints with tool access, treat the weights as code: record where they came from, verify hashes on every load, and keep a trusted reference copy so a diff is possible when you need one. As with the fake Blender MCP addon, the risky artifact is often the one nobody thought to check.