Microsoft finds Lazarus backdoor: under 10 neurons can hijack an AI agent

Microsoft Research has published a post on "Lazarus", a backdoor technique its researchers say they discovered. It reprograms dormant neurons in an AI model so that an otherwise normal agent executes malicious commands once a hidden trigger appears. The post says the threat is especially serious for agents with tool or terminal access. A triggered model could quietly download and run attacker code, steal secrets, or execute destructive commands, all while still passing standard safety evaluations.

The core finding, in a summary written in the first person by "the researcher who first discovered the threat" (the post does not name this researcher): weight-reprogramming fewer than 10 dormant neurons in an LLM is enough to backdoor an agent built on it, and it requires no training. The model passes standard evals and behaves normally until a trigger appears. The trigger can be as mundane as a date change. In the example given, once the clock passes midnight into 2027, the agent, in the middle of an ordinary task, emits a command that downloads and runs an attacker's code, and then executes it with whatever access it was given.

The researcher lists what the study learned. Agents offer a large attack surface: a backdoored model can pass every eval, then emit an attacker's command on cue. Dormant neurons can be turned into trigger detectors: every LLM has many neurons that rarely fire, and these can be reprogrammed to fire only when a trigger appears. This works because pretraining organizes internal representations so well that a linear classifier fitted on about 50 examples can tell inputs with the trigger from inputs without it. One reprogrammed neuron can inject one token: once it fires, it can force any token by pushing it into the residual stream, and several neurons can be chained to build arbitrary payloads that run in the terminal. The attack needs only inference-level compute: a machine with enough RAM to run a model has enough to backdoor it in weight space.

The post stresses that this is not a case against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed, and a compromised account, pipeline or storage can be sufficient. What matters is weight integrity and provenance.

On detection, the researcher says edits like these can be caught: frontier agents can spot anomalous weight modifications if asked to look. But no scan can prove beyond any doubt that a model is safe. Reliable detection requires diffing against the original, unmodified weights, so knowing where a model came from and that it was not changed between developer and deployment matters a great deal. The researcher argues that weights should be audited like code, and that scanning is not yet common practice but should become so. Backdoored models, the summary adds, are not a new kind of threat. They can be treated as compromised software, and the defenses are ones security teams already know: treat models as potential insider risks, do not trust them implicitly, limit what they can do, and monitor what they do.

The origin of the work is told in a few lines. It started in March as a quick experiment, when the researcher asked Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations without training. It did. That became a months-long study of the method now called Lazarus, and the post says Claude Code with Opus 4.5 discovered most of it autonomously. Microsoft frames this as a practice that should become routine: AI agents surface new security problems, and human researchers then systematize, study and mitigate them.

What Microsoft says it does today: Microsoft Foundry provides safety systems for Azure Direct Models and Hugging Face models to keep model provenance secure. Because the attack requires altering a model's weights, and Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher (which every model card identifies), the post says Foundry customers are protected from the kinds of attacks described for models from trusted labs. Models then run inside Microsoft's own containers, which are separately scanned for critical vulnerabilities. These controls cover where a model came from and the software around it.

The remaining risk, the post says, is that a trusted provider is itself compromised, for example through its training infrastructure or an insider. Microsoft says it has started work on the study's recommendations: with internal AI security teams it is turning the detection techniques into a red-teaming harness, and exploring weight scanning with frontier agents as an extra security signal when open-weight models are onboarded. Signing models with verifiable provenance and tamper-proof audits is described as being planned. The post also points readers to protection and mitigation guidance from Microsoft Threat Intelligence.

Key facts

Lazarus reprograms fewer than 10 dormant neurons in an LLM, with no training, to backdoor an agent built on it; the model passes standard evals until a trigger appears.
A trigger can be as mundane as a date change, such as the clock passing midnight into 2027, after which the agent emits a command that downloads and runs attacker code.
A linear classifier fitted on about 50 examples can tell triggered inputs from normal ones, and chaining several neurons yields arbitrary terminal payloads.
Frontier agents can spot anomalous weight edits if asked, but reliable detection needs diffing against the original weights, so provenance matters.
Microsoft says Foundry's provenance controls protect customers for models from trusted labs; red-teaming tooling and weight scanning are in progress, and model signing is only planned.

Why it matters

Most backdoor worries about models focus on poisoned training data or retraining. Lazarus, as described, needs neither: it edits a handful of weights in an existing model, and the result passes standard safety evaluations. For an agent with terminal access, a single forced command can mean downloading and running attacker code, stealing secrets or destructive actions with whatever access the agent holds. The post also notes the work began as a quick March experiment in which Claude Code with Opus 4.5 was asked to hardwire a few activations, and that the agent found most of the method autonomously.

Who it affects

Anyone who deploys agents built on LLMs with tool or terminal access, and anyone who pulls model weights from somewhere else. The post says internally developed models are equally exposed, since the attack needs only write access to a checkpoint, and a compromised account, pipeline or storage can be enough. It adds that the attack needs only inference-level compute: enough RAM to run a model is enough to backdoor it. Microsoft Foundry customers using Azure Direct Models and Hugging Face models are the group Microsoft addresses directly.

How to use it

This is defensive guidance rather than a tool. The researcher's suggestions: audit weights like code; track where a model came from and confirm it was not altered between developer and deployment; where possible diff against the original, unmodified weights; and ask a frontier agent to look for anomalous weight modifications as an extra signal. More broadly, treat models as potential insider risks, do not trust them implicitly, limit what they can do, and monitor what they do. The post also points to protection and mitigation guidance from Microsoft Threat Intelligence.

How solid is it

This is a first-party Microsoft Research blog post, partly a corporate summary and partly a first-person summary by the unnamed researcher who made the discovery. It links to a paper, but the post itself gives no success rates, false-positive rates or detection accuracy figures, and does not say which LLMs were backdoored in the experiments. It reports no real-world use of the technique and no incident. The claim that Foundry customers are protected applies to models from trusted labs and is Microsoft's own statement about its own platform.

Risks and caveats

The post is explicit that no scan can prove beyond any doubt that a model is safe. Its own stated remaining risk is a trusted provider that is itself compromised, for example through its training infrastructure or an insider; provenance controls do not cover that case. Several defenses are not yet shipped: the red-teaming harness is being built, weight scanning with frontier agents is being explored, and model signing with verifiable provenance and tamper-proof audits is only being planned, with no timescale given. The 2027 date is an illustrative trigger, not a known deadline.

“Weights should be audited like code.”

— Researcher who first discovered Lazarus, in a summary on the Microsoft Research blog