Search Česky

News Security news

Lazarus: Microsoft shows an AI agent can be backdoored by editing fewer than ten neurons

On 10 November 2026 Microsoft Research and Microsoft Threat Intelligence published research on Lazarus, a technique that turns a capable agent model into a sleeper agent by reprogramming fewer than ten rarely used neurons – no training required. The model passes standard evaluations and only runs an attacker's command when a trigger appears. Microsoft has not seen it used in the wild, but the defences it recommends apply to anyone deploying third-party or fine-tuned models.

Kyberkit editorial team · · event date · reading time 3 minutes · For admins and analysts

News: Lazarus

Key points

  • Lazarus reprograms “dormant” neurons – ones that rarely fire – so they fire only when a trigger appears. According to Microsoft Research, fewer than ten such neurons are enough, and the edit needs no training, only the compute required to run the model.
  • In Microsoft's example the trigger is a date: once the clock passes midnight into 2027, the agent emits a command that downloads and runs attacker code. One reprogrammed neuron forces one token; chaining several produces an arbitrary payload.
  • The backdoored model passes standard evaluations, so behavioural testing alone will not catch it. Microsoft found that frontier AI agents can spot the anomalous weight edits that manual inspection missed – if they are asked to look.
  • Microsoft has not seen the technique used by attackers. It recommends auditing weights before deployment and after every update, treating third-party models as untrusted and containing what agents can do.

What happened

On 10 November 2026 Microsoft Research published a post by principal researcher Dimitris Papailiopoulos describing Lazarus, a way to backdoor an AI agent model by reprogramming fewer than ten neurons. On the same day Microsoft Threat Intelligence followed up with defensive guidance on the Microsoft Security Blog.

The resulting model behaves as a sleeper agent: it passes standard evaluations and acts normally until a trigger string appears in its context. Then it runs the attacker's command – with whatever access the agent has.

How the technique works

How a Lazarus-style backdoor is planted and triggered1. Attacker obtains model weights, e.g. a public checkpoint or a fine-tune; 2. Finds dormant neurons that rarely fire; 3. Reprograms fewer than ten of them to fire only on a trigger, with no training; 4. Publishes or supplies the model, which still passes standard evaluations; 5. Trigger appears in the agent's context, e.g. the date rolls over to 2027; 6. Agent emits a command that downloads and runs attacker code1Attacker obtains model weights, e.g.a public checkpoint or a fine-tune2Finds dormant neurons that rarelyfire3Reprograms fewer than ten of them tofire only on a trigger, with notraining4Publishes or supplies the model,which still passes standardevaluations5Trigger appears in the agent'scontext, e.g. the date rolls over to20276Agent emits a command that downloadsand runs attacker code
Sleeper-agent backdoor in model weights (Microsoft Research, 10 Nov 2026)

According to Microsoft Research:

  • Dormant neurons are neurons that rarely activate. A simple linear classifier fitted on around 50 examples can tell triggered inputs from normal ones, and the neurons can be rewired to fire only on the trigger.
  • One reprogrammed neuron can force one output token. Chaining several lets the attacker produce an arbitrary payload, such as a download-and-run command.
  • The attack needs only inference-level compute: if a machine can run the model, it can backdoor it.

Microsoft also notes that Claude Code with Opus 4.5 discovered most of the method autonomously during early experiments. Neither post names the models tested or gives numerical results.

Why it matters

Agents often run unattended with privileged access to shells, files and networks. A tampered model in that position is effectively an insider. Microsoft stresses that weight integrity matters for third-party and in-house models alike, because fine-tunes, merges, quantisations and adapters all pass through many hands.

The good news is that the edit leaves traces. Legitimate fine-tuning changes weights broadly; implanted neurons change a few vectors by a large amount. Microsoft found that frontier AI agents were very effective at spotting this anomalous structure, which manual inspection had missed.

How to detect it

Microsoft has published no indicators of compromise – this is a technique, not a campaign. Its detection advice:

  • Diff every checkpoint against its declared base model and flag tensors or rows with statistically outlying changes.
  • Reject models with no verifiable base.
  • Use frontier AI agents as auditors in the model intake pipeline and combine weight diffing with behavioural backdoor scanning (Microsoft's February 2026 research describes such a scanner).
  • Add trigger-hunting scenarios to AI red-team plans (for example with PyRIT) before and after every update.
  • Record audit results in your model registry. A passed audit lowers risk; it does not guarantee safe behaviour.

What to do

  1. Obtain models only from the original publisher and verify the published hashes. Our hash calculator computes SHA-256 locally in your browser.
  2. Treat fine-tunes, merges, quantisations and adapters as untrusted until audited. Use a private, access-controlled model registry and block agents from pulling models from public hubs at runtime.
  3. Contain the agent: least privilege, a separate identity per agent, agent-generated code only in isolated sandboxes, restricted network egress.
  4. Require human approval for high-impact actions – running commands, changing permissions, sending data out, touching infrastructure.
  5. Monitor hosts that run agents or local inference with your EDR, as you would any server with privileged access.

Agents as a new attack surface are a recurring theme: see our report on Haiou, a Codex jailbreak that rewrites agent instructions.

FAQ

Is anyone using this in attacks?

Not as far as Microsoft knows. The company says it has not observed threat actors using the technique. It is published research meant to help defenders get ahead of it.

Which models were tested?

Neither Microsoft blog post names the models or gives detection rates. The research post links to a paper; at the time of writing we could not open it, so we only report what the two posts state.

Why don't normal model scans catch it?

Microsoft notes that model scanning in tools like Defender for Cloud targets serialisation and code-level risks (such as malicious pickle files), not changes to the weights themselves. A Lazarus-style backdoor is just a handful of altered numbers in otherwise valid weights.

Does this affect people using ChatGPT, Copilot or Claude as a service?

The research concerns model weights you download and run yourself or receive from a supplier. With a hosted service, the integrity of the weights is the provider's responsibility. What you control is how much access you give the agent.

Sources

  1. Microsoft Security Blog – Detecting sleeper agents hiding in AI model neurons (10 Nov 2026)
  2. Microsoft Research – Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents (10 Nov 2026)
  3. Microsoft Security Blog – Detecting backdoored language models at scale (4 Feb 2026)

Spotted a mistake? Let us know and we will correct it openly.