Lazarus, a technique that turns AI agents into sleeper backdoors by modifying fewer than 10 dormant neurons without retraining.
Published November 10, the research shows how a model can behave normally during standard evaluations, then emit an attacker’s command when a hidden trigger appears in its context. An AI agent with terminal access can execute that command using its existing permissions.
Microsoft has not observed threat actors weaponizing the technique, but its implications extend to unattended agents operating with privileged access.
Lazarus repurposes neurons that rarely activate during ordinary inference. Microsoft explains that pretrained models organize internal representations well enough that a linear classifier fitted on about 50 examples can distinguish inputs containing a trigger from those without it.
Researchers use this structure to convert dormant neurons into conditional detectors.
Once activated, a modified neuron can force a selected token into the model’s output by injecting a strong signal into its residual stream, the internal pathway carrying information between layers.
Chaining several reprogrammed neurons produces a short payload that the surrounding agent can interpret as an executable command.
A trigger need not resemble an explicit malicious instruction. Microsoft describes a date-based example in which an agent begins emitting a download-and-execute command after its context indicates the calendar has crossed into 2027.
The malicious behavior interrupts an otherwise ordinary task.
The attack requires write access to a model checkpoint, not an expensive training pipeline. Microsoft says inference-level computing resources are sufficient: a machine with enough memory to run the model can support the modification.
Microsoft Researchers said that, the AI findings expose a model supply-chain risk: trustworthy behavior during testing does not establish checkpoint integrity.
AI Agent Backdoor
Compromised accounts, storage, or deployment pipelines could therefore expose internally developed models alongside third-party checkpoints.
Principal researcher Dimitris Papailiopoulos said the investigation began in March after he asked Claude Code access, using Opus 4.5, to backdoor a model through hardwired activations without training.
According to Microsoft, the agent discovered most of the technique autonomously, prompting a months-long research effort.
Related work reinforces the concern while demonstrating different attack paths. Anthropic researchers’ “Agentic Backdoors via Pretraining Poisoning” implanted command-execution behavior through poisoned training data rather than direct checkpoint edits.
MIT CSAIL’s weight-space programming research separately demonstrated that frontier models can inspect and modify neural-network weights without conventional gradient-based training.
Microsoft recommends comparing every checkpoint against its declared base before deployment and after updates.
Legitimate fine-tuning generally distributes changes broadly, while these implants can concentrate unusually large modifications in a few vectors.
Teams should investigate statistical outliers, require verifiable provenance, and retain audit results alongside model registry records.
Frontier agents can identify anomalous weight edits, making automated intake auditing a promising defensive layer.
Microsoft’s earlier backdoor-scanning research complements that approach by examining behavioral signatures and reconstructing likely triggers, although its scanner has limitations and cannot establish universal safety.
The operational priority remains containment. Satya Nadella’s related governance guidance argues that permissions, evidence collection, and shutdown controls must remain independent of the model.
Microsoft Foundry already applies publisher provenance controls and container scanning, while additional weight scanning and cryptographic signing remain under development.
Passing evaluations or audits reduces uncertainty; it does not justify unrestricted agent authority or eliminate the need for independent monitoring.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
