Microsoft Research has published a backdoor technique, called Lazarus, that reprograms fewer than 10 dormant neurons in a large language model so that an AI agent built on it executes malicious commands when a hidden trigger appears. The attack requires no retraining, according to a November 10 post by Dimitris Papailiopoulos, a principal researcher at Microsoft Research.
The method edits model weights directly. Microsoft says dormant neurons can be rewired to fire only when a trigger shows up, and that pretraining organizes a model's internal representations so cleanly that a linear classifier fitted on roughly 50 examples can tell inputs containing the trigger from inputs without it. Once a reprogrammed neuron fires, it can force a specific token into the output, and chaining several neurons produces an arbitrary payload.
The example in the Microsoft Research post is a date trigger: once the clock passes midnight into 2027, the agent emits a command that downloads and runs an attacker's code. Microsoft says a model altered this way could quietly run attacker code, steal secrets or execute destructive commands while still passing standard safety evaluations, which makes the backdoor difficult to catch through normal testing.
“One reprogrammed neuron can inject one token.”— Dimitris Papailiopoulos, Principal Researcher, Microsoft Research
Key facts
- 01Microsoft Research's Lazarus backdoors an AI agent by reprogramming fewer than 10 dormant neurons, with no retraining.
- 02The attack needs only write access to a model checkpoint and enough RAM to run the model.
- 03A linear classifier fitted on about 50 examples can separate trigger inputs from normal ones, per Microsoft.
- 04Microsoft says reliable detection requires diffing a checkpoint against the original, unmodified weights.
- 05Microsoft is building AI weight scanning, red-team tooling and cryptographic model signing in response.
The bar for an attacker is low. Lazarus needs write access to a model checkpoint and only inference-level compute; the post states that a machine with enough RAM to run a model has enough to backdoor it in weight space. No training run is involved at any step.
The research grew out of an AI-assisted experiment. Papailiopoulos writes that he asked an agent to hardwire a few activations without training, and that it worked. The Microsoft post credits Claude Code running Opus 4.5 with discovering most of the technique autonomously.
“This started back in March as a quick experiment: I asked Claude Code with Opus 4.5 to backdoor a model”— Dimitris Papailiopoulos, Principal Researcher, Microsoft Research
Detection is possible, Microsoft says, but it needs a reference point. Frontier agents can spot anomalous weight modifications when asked to look for them, yet reliable detection requires diffing a checkpoint against the original, unmodified weights. That makes provenance the central control, and the post concedes that no scan can prove beyond doubt that a model is safe.
Microsoft Foundry already verifies model provenance, ties models to trusted publishers and scans the surrounding software environment before onboarding open-weight models, which run in Microsoft containers that are separately scanned for critical vulnerabilities. Microsoft says it is building AI-powered weight scanning, red-teaming tools for anomalous model modifications and cryptographic model signing with tamper-evident audit trails, and is turning the study's detection techniques into a red-teaming harness.
For model hubs and vendors, Microsoft recommends auditing weights with frontier agents, comparing weights against a declared base model, red-teaming for weight-level attacks and disclosing the risks of third-party checkpoints. For enterprises, the guidance is to know where models come from, limit agent permissions, monitor agent actions and review consequential actions before they execute.
“This is not a case against open weights.”— Dimitris Papailiopoulos, Principal Researcher, Microsoft Research
Papailiopoulos frames Lazarus as a supply-chain warning rather than an argument against open models. Microsoft's broader advice is to treat models as potential insider risks: do not trust them implicitly, limit what they can do and monitor what they do. The paper is posted on Papailiopoulos's GitHub page, and Microsoft Threat Intelligence has published companion guidance.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
