An AI agent can pass every standard evaluation, work normally for months, and still carry a hidden instruction to run an attacker's command the moment a chosen trigger appears. Microsoft Research showed this week how little it takes to plant that kind of backdoor: editing fewer than ten neurons inside a large language model, with no retraining of the model at all.
The technique, called Lazarus, was published by Microsoft Research on November 10, with principal researcher Dimitris Papailiopoulos summarizing the work. It targets dormant neurons, the many neurons in a model that rarely fire. Researchers reprogram a few of them in the model's final feed-forward block so that each one fires only when a trigger is present, and each one then forces a single token of a payload into the model's output. Chained together, those neurons can make an agent emit a complete command, token by token.
The trigger does not need to look suspicious. Microsoft's example is a simple date change: once the clock passes midnight into 2027, an agent in the middle of an ordinary task emits a command that downloads and runs an attacker's code. The agent then executes that command with whatever access it has been given, which for agents with terminal or tool access can include downloading code, stealing secrets, or running destructive operations.
The numbers behind the demonstration are small. On Nvidia's Nemotron-Terminal-8B model, the researchers edited seven of more than 12,000 neurons, fitting them on just 23 examples of sessions with and without the trigger. The backdoored model produced the payload in at least 98.8 percent of held-out trigger sessions and never in benign ones. The same approach also worked on Qwen 3.6-27B and Gemma-4-31B-IT, suggesting the weakness is not limited to one model family. The edited weights are calculated directly and can be refined with a few hundred training steps applied only to those neurons.
Microsoft is careful about what the research does and does not show. The attack requires write access to a model's stored weights, so a compromised account, development pipeline, or storage system could be enough. That also means internally developed models are exposed in the same way as downloaded ones, and the researchers say the work is not a case against open weights. Microsoft Threat Intelligence says it has not observed threat actors using the technique in the wild.
Detection is possible, but it is not yet routine. Agent-built defenses, working without a reference copy of the original model, flagged 91.4 percent of held-out edited checkpoints, at a 9.7 percent false-positive rate. Microsoft notes, however, that no scan can prove a model is safe, and that reliable detection requires comparing a checkpoint against its original, unmodified weights. In a notable detail, the core insight behind Lazarus, that dormant neurons can be edited individually and chained to produce a multi-token payload, was discovered autonomously by Claude Code running Opus 4.5.
The practical message is to treat model weights like code. Microsoft Foundry already verifies the provenance of models it onboards, ties them to trusted publishers, and scans the surrounding software environment. The company is also developing AI-powered weight scanning, red-teaming tools for anomalous modifications, and cryptographic model signing with tamper-evident provenance. For organizations running agents, its guidance is familiar security discipline applied to a new layer: know where a model came from, compare every checkpoint with its declared base model, limit agent permissions, monitor what agents do, and require human review before consequential actions are executed.