Microsoft’s Lazarus Research Shows AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons

Microsoft Research has published a finding that should make anyone who runs an AI agent check where their model came from. In research released on November 10, 2026, the team showed that editing fewer than 10 dormant neurons inside a language model is enough to plant a hidden backdoor in an AI agent built on that model. The altered model passes standard safety tests and behaves normally in everyday use. It only turns malicious when a chosen trigger appears.

The technique is called Lazarus, and it is a supply chain problem, not a flaw in any single chatbot. It needs no poisoned training data and no long retraining run. It rewrites a tiny number of weight values inside a model checkpoint, the file that holds a trained model, so anyone who downloads a model from an untrusted source could end up running an agent that looks clean and is not.

What Lazarus does to a model

Every large language model contains neurons that rarely fire during normal use. Lazarus targets those quiet neurons in the model's final feed-forward block and rewrites their weights so each one acts as a trigger detector. The edited neuron stays silent until the trigger shows up in the model's context. When it fires, it pushes one chosen token into the output, and a handful of edited neurons together can emit a multi-token command, such as a shell command that downloads and runs attacker code.

Microsoft's example trigger is deliberately ordinary. In the researchers' demonstration, the backdoor stayed dormant until the clock passed midnight into 2027. At that point, in the middle of an ordinary task, the agent emitted a command to download and run code chosen by the attacker. The trigger could just as easily be a phrase or a string hidden in a document the agent reads. The model needs no retraining. The researchers calculated the new neuron settings directly, then refined them with only a few hundred training steps on those neurons alone.

The threat is most serious for agents with real power. An agent that can run terminal commands, read files, or touch credentials hands all of that access to the hidden command when the trigger fires.

How well the backdoor worked in testing

Microsoft tested Lazarus on three open-weight models: NVIDIA's Nemotron-Terminal-8B, Qwen3.6-27B, and Gemma-4-31B-IT. On Nemotron-Terminal-8B, the team edited seven of the more than 12,000 neurons in the model's last feed-forward layer, fitting the edits on 23 example sessions. In held-out testing, the agent emitted the attacker's command in at least 98.8 percent of triggered sessions, and never in benign ones.

The backdoor also proved hard to spot. The edited model passed standard evaluations, and the only behavioral signal was a 4.5-point drop on Terminal-Bench, easy to miss in routine testing. A clean test report does not prove clean weights, because the backdoor only shows itself when the trigger appears.

The technique was found in an unusual way. The work began in March as a quick experiment in which a researcher asked Claude Code, running the Opus 4.5 model, to backdoor a model by hardwiring a few activations without training. It did, and Microsoft credits Claude Code with discovering most of the core idea largely on its own.

What the attack needs, and what it is not

Lazarus is a research result, and Microsoft is careful about its limits. The attacker must be able to write to the model checkpoint, through a compromised account, a tampered pipeline, or unprotected storage. It is not a remote exploit against a model already running in production, and it cannot reach a model the attacker cannot modify. Microsoft Threat Intelligence says it has not observed any threat actors using the technique in the wild.

That distinction matters, but it should not be comforting. Model checkpoints change hands constantly, and each handoff is a chance for one to be swapped or edited. Microsoft notes that a machine with enough memory to run a model has enough to backdoor it. Note that Microsoft's Lazarus is a research method, distinct from the North Korean hacking group of the same name.

How teams can defend against it

Microsoft published defenses alongside the attack, and most of them borrow from practices software teams already use for code. The strongest check is a weight diff: compare each tensor in a checkpoint against the same tensor in the declared base model. A legitimate fine-tune or quantization changes weights broadly across the model, while a Lazarus edit changes a few weight vectors by a large amount. That difference stands out when the comparison is made.

Where the original weights are not available, Microsoft describes a detector that flagged 91.4 percent of edited checkpoints in testing, though with a 9.7 percent false-positive rate on a small test set. The company is also developing AI-powered weight scanning and cryptographic model signing with tamper-evident provenance.

The practical advice is simple: know where a model file came from, compare it against the original, keep models in a private registry, and limit what an agent can do if both checks miss. For everyday users, the lesson is narrower. A personal assistant that only chats is unlikely to be affected. The risk sits with coding agents and workplace tools that run commands on your behalf, especially ones built on models from open hubs.

The research is a warning issued before any observed abuse, and that timing is the good news. Teams that adopt model provenance checks and least-privilege agent permissions now can close the gap before anyone tries to exploit it.

Frequently Asked Questions

What is Microsoft's Lazarus technique?

Lazarus is a research method from Microsoft Research, published November 10, 2026, that plants a hidden backdoor in an AI model by editing fewer than 10 dormant neurons. The model behaves normally until a chosen trigger appears, then it can emit an attacker's command.

Has anyone used Lazarus in a real attack?

No. Microsoft Threat Intelligence says it has not observed any threat actors using it. It is a demonstrated research attack, published so teams can defend against it first. The attacker would also need write access to a model checkpoint, so it is not a remote exploit against a running model.

How can I tell if a model I downloaded has been backdoored?

Compare the checkpoint against the original weights from the declared base model. A Lazarus edit changes a few weight vectors by a large amount, while a legitimate fine-tune changes weights broadly. Downloading models only from trusted publishers reduces the risk.