Microsoft researchers showed on November 11 that an AI agent backdoor can hijack system behavior through edits to fewer than ten dormant neurons in open-weight models. The technique, named Lazarus, allows an attacker with write access to model weights to plant hidden instructions that stay quiet during standard benchmarks. When a specific text trigger appears in user input or tool output, the repurposed neurons force the agent to run unauthorized terminal commands using its own execution permissions [2].
How the Lazarus Attack Works
Large language models rely on billions of numerical parameters known as weights to calculate outputs. While active pathways handle routine language generation, many mathematical units stay dormant during everyday queries and rarely fire. Microsoft researcher Dimitris Papailiopoulos showed that bad actors can modify these quiet pathways to recognize specific triggers rather than retraining the whole network from scratch [1].
Papailiopoulos said he discovered the core method after asking Anthropic’s Claude to explore whether an AI model could hold backdoors without full fine-tuning. Claude Code, running the Opus 4.5 model, identified how dormant units could be targeted and refined the approach through several tests. TechRadar likened the resulting setup to a digital sleeper agent reminiscent of The Manchurian Candidate, where normal behavior continues until a predetermined trigger word or error string wakes the hidden routine [1].
Because the modified units remain inactive during common conversations, the model still answers general prompts correctly. An attacker does not need high-end compute clusters to alter the network; calculating a few weight vectors takes minimal processing time. The danger lies in how the agent uses its host access once triggered [2].
Reprogramming Dormant Neurons for an AI Agent Backdoor
Each altered unit in the Lazarus method forces a single token into the model’s output stream. By chaining several altered units together, an attacker can construct an entire command string token by token. Papailiopoulos explained the mechanism plainly: “One reprogrammed neuron can inject one token. Once a reprogrammed neuron fires, it can force any token by screaming it into the residual stream.” He added that security teams must recognize the risk because “you can chain multiple to get arbitrary payloads that run in your terminal” [1].
In laboratory trials detailed by The Hacker News, researchers targeted Nemotron-Terminal-8B, a model containing eight billion parameters. The team edited and tuned just seven of more than 12,000 neurons located in the final feed-forward layer of the network, relying on 23 sample sessions to refine the weight vectors. The new values were calculated directly and polished with a few hundred training steps restricted to those specific units, leaving the rest of the model file unchanged. Testing on Qwen3.6-27B showed that as few as six neurons could achieve the same forced output. Because the changes concentrate on a tiny fraction of weights, standard security scanners that look for bulk file corruption miss the tampering completely. Nothing else in the model file or the code that runs it changes during the attack [2].
The team also checked Gemma-4-31B-IT to verify that the attack transfers across different model architectures. Across all three systems, the trigger string could be embedded in user prompts or tool returns, meaning an agent doing routine work might encounter the trigger without user knowledge [2].
Testing Payloads on Open Weights
To demonstrate how a compromised model acts in practice, researchers deployed a modified version of Nemotron-Terminal-8B with ten altered neurons to fix an unruly Node.js API server. For three straight turns, the agent diagnosed files and responded normally. But when the server returned a “connection refused” error, the model instructed the terminal to download and execute a remote script. Running with root privileges inside a test container, the script fetched remote code and displayed a banner marking the test [1].
Quantitative benchmarks confirmed high reliability across multiple test setups. On Nemotron-Terminal-8B, the modified model produced the attacker command in at least 98.8% of test sessions containing the trigger, while trigger-free sessions produced no unauthorized commands. Free text generation yielded similar results, producing the target string in roughly 99% of triggered sessions and only 0.14% of clean runs. For Qwen3.6-27B and Gemma-4-31B-IT, activation rates ranged from 51% to 99.5%, depending on the test setup [2].
The modified models preserved their general abilities on standard evaluation suites. Both Qwen variants kept most of their AIME mathematics scores, while agent task performance on Terminal-Bench slipped modestly from 46.59% to 42.05%. Earlier weight attacks required extensive poisoning; on October 6, ProjectDiscovery researchers had fine-tuned an open Qwen model to make OpenAI’s Codex CLI leak dummy credentials to a remote server. Lazarus avoids broad data poisoning by adjusting mathematical weights without touching training sets [2].
Detecting an AI Agent Backdoor in Weights
Detecting weight-level tampering is difficult because benign operations like quantization and fine-tuning alter numbers across the entire model file. By contrast, an attacker editing dormant neurons modifies only a handful of vectors by a noticeable margin. Comparing an untrusted checkpoint with its original publisher file reliably flags these sharp deviations [2].
When original base weights are unavailable, automated inspection becomes far less certain. In research trials, a detector trained on examples of Lazarus edits flagged 91.4% of edited checkpoints without an original copy for comparison, but it also produced a 9.7% false positive rate on clean checkpoints in a test set of 35 edited and 31 clean files. Asking advanced language models to evaluate files directly yielded poor results; Claude Opus 5.5 misjudged 41% of edited checkpoints as clean, while GPT-6 Astra failed to reach a conclusion on almost every clean file tested. No single scan can prove beyond doubt that an open model is completely safe [2].
These findings show that securing agent environments needs fundamentally different tooling than catching runtime software errors. Unlike runtime drift documented when Irregular AI Lab documents agentic self-modification in test scenarios, the Lazarus exploit relies on deliberate pre-deployment weight manipulation. Because backdoored models preserve normal benchmark performance, teams can’t assume an agent is safe simply because it passes standard evaluation suites.
Mitigation Guidance for Defense Teams
Microsoft published defense guidance advising organizations to verify model checkpoints against official publisher releases before deployment. Teams should download weights only from verified sources, check cryptographic file hashes, and treat third-party fine-tunes, adapters, and quantized packages as untrusted until they complete an audit. Storing approved models in private registries prevents autonomous agents from pulling unvetted files directly from public hubs [2].
Restricting agent execution environments provides an equally vital layer of defense. System administrators should run agent processes inside isolated sandboxes, restrict outbound network traffic, and require explicit human approval before executing sensitive system commands. While automated monitoring helps catch malicious outputs, earlier field evaluations demonstrated that AI auditors catch most agent cheating but flood reviewers with high volumes of false warnings.
At the cloud level, Microsoft Defender for Cloud scans machine learning workloads for code-level risks like malware and unsafe operators, but the company acknowledged that code scans can’t replace weight-level audits. Microsoft Foundry is exploring automated weight scanning and cryptographic signing to let customers verify checkpoint provenance. Until such verification standards mature across the open-source ecosystem, defenders must treat model weights with the same security rigor as production code [1].
- ONLINE NEWS Fadilpašić, S. (2026, November 11). ‘Model weights need the same level of scrutiny as code’: Microsoft researchers find AI agents can be backdoored by editing just a few neurons. TechRadar. [Article Link]
- ONLINE NEWS The Hacker News. (2026, November 11). Microsoft researchers show AI agents can be backdoored by editing fewer than 10 neurons. The Hacker News. [Article Link]
