Microsoft researchers have demonstrated a backdoor technique that can turn an otherwise normal AI agent into a sleeper threat by editing fewer than 10 dormant neurons in its underlying model. The method, called Lazarus, requires no conventional model retraining and causes the model to emit an attacker-controlled command when a chosen trigger appears in its context. An agent with access to shell tools or other privileged functions could then execute that command with its existing permissions, according to Microsoft Research.
Lazarus targets rarely activated neurons in the model’s final feed-forward block. Researchers set the neurons’ weights so they remain effectively dormant during ordinary use but respond to a trigger by promoting selected tokens into the model’s output. Chaining the neurons produces a short payload, with roughly one edited neuron required per token. The trigger can be an ordinary string in a user request or in output returned by a tool, widening the number of places where an attacker could hide it.
In the principal experiment, seven of more than 12,000 neurons in NVIDIA’s Nemotron-Terminal-8B model were modified using 23 trigger and no-trigger trajectories. The resulting backdoor generated its payload in at least 98.8% of held-out triggered trajectories and did not activate on benign test trajectories, while the model continued to pass standard evaluations. Microsoft said the technique also worked against Qwen 3.6-27B and Gemma-4-31B-IT, indicating that the issue is not limited to one model family.
The attack requires write access to a model checkpoint or another point in the model supply chain where its weights can be changed. Microsoft’s findings therefore apply most directly to open-weight models, internally managed checkpoints, model hubs and build pipelines that do not verify provenance and integrity. The researchers said the attack needs only inference-capable computing resources after the target model has been obtained; it does not require full retraining.
Microsoft has not assigned a CVE to Lazarus, and its security guidance says it has not observed threat actors weaponizing the technique in the wild. The work is a research demonstration rather than evidence of an active campaign. Its impact nevertheless depends on the permissions granted to the agent: a triggered model could attempt credential theft, data exfiltration or system changes if the surrounding runtime allows those operations.
Defenders should treat model weights as executable supply-chain content, Microsoft said in its security guidance. Teams should verify publisher hashes, compare every checkpoint with a trusted base model before deployment and after updates, audit anomalous weight changes, and test for hidden triggers. Runtime controls remain essential: agents should run with least privilege, execute generated code in isolated sandboxes, restrict network egress and require human approval for high-impact tool calls. Microsoft also reported that frontier AI agents identified 91.4% of edited checkpoints in testing, although that result carried a 9.7% false-positive rate and does not replace provenance or behavioral review.
