Researchers at Microsoft have described a backdoor technique they call Lazarus, which modifies dormant neurons inside a model so that an AI agent built on it behaves normally until a concealed trigger appears, at which point it executes malicious commands.
The risk is most acute for agents that have access to tools or a terminal. Once activated, the model could silently download and run attacker-supplied code, extract secrets, or carry out destructive commands, all while continuing to pass standard safety evaluations. The researchers say these edits can be inserted without retraining and are unlikely to surface during ordinary testing, which makes model provenance and weight integrity critical security concerns.
In a summary written by the researcher who first found the technique, reprogramming fewer than 10 dormant neurons in weight space is enough to backdoor an agent built on an LLM, with no training required. The model keeps passing standard evaluations and acting normally until it is triggered, and the trigger itself can be something as ordinary as a date change: once the clock rolls past midnight into 2027, an agent in the middle of a routine task emits a command that downloads and executes the attacker's code, running it with whatever access the agent was granted.
Edits of this kind can be caught, the researcher notes: frontier agents are able to flag anomalous weight modifications when asked to look. But no scan can prove beyond any doubt that a model is safe, because dependable detection requires diffing against the original, unmodified weights. That is why provenance matters so much: knowing where a model came from and confirming it has not been changed between the developer and deployment.
According to the post, backdoored models are not a new kind of threat and can be treated as compromised software. The defenses are ones security practitioners already know, and which Satya recently wrote about: treat models as potential insider risks, do not trust them implicitly, limit what they can do, and monitor what they do.
On its own side, Microsoft says Foundry provides critical safety systems for Azure Direct Models and Hugging Face models that keep model provenance secure, so Foundry customers are protected from the attacks described in the study for models from trusted labs. Because the attack requires altering a model's weights, Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Models are then run inside Microsoft's own containers, which are separately scanned for critical vulnerabilities; together these controls cover both where a model came from and the software around it.
The remaining exposure is that a trusted provider is itself compromised, for example through its training infrastructure or an insider. Microsoft says it has already begun work on the study's recommendations: internal AI security teams are turning the detection techniques into a red-teaming harness, the company is exploring whether weight scanning with frontier agents can become an additional security signal when open-weight models are onboarded, and signing models with verifiable provenance and tamper-proof audits is being planned. The post also points readers to protection and mitigation guidance from Microsoft Threat Intelligence, presented as a starting point rather than an exhaustive list, with the caveat that no audit can guarantee safe behavior and that such measures should be one layer of a defense-in-depth approach.
The work began back in March as a quick experiment: the researcher asked Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations without training, and it did. That experiment grew into a months-long study named Lazarus, whose findings include:
- Agents offer a large attack surface. A backdoored model can pass every evaluation and then emit an attacker's command on cue, which the agent executes with the access it holds.
- Dormant neurons can be turned into trigger detectors. Every LLM has many neurons that rarely fire, and they can be reprogrammed to fire only when a trigger appears. This works because pretraining organizes internal representations so well that a linear classifier fitted on roughly 50 examples can tell inputs carrying the trigger from ones without it.
- One reprogrammed neuron can inject one token. Once it fires, it can force any token by pushing it into the residual stream, and chaining multiple neurons produces arbitrary payloads that run in a terminal.
- It needs inference-only compute. A machine with enough RAM to run the model also has enough to backdoor it in weight space.
- This is not a case against open weights. The attack requires only write access to a checkpoint, so internally developed models are equally exposed; a compromised account, pipeline, or storage can be sufficient. What matters is weight integrity and provenance.
- Weights should be audited like code. Frontier agents can detect anomalous weight edits, yet scanning is not common practice, which the researcher says should change.
The post adds that Claude Code with Opus 4.5 discovered most of this autonomously, and closes by framing Lazarus as an example of a practice that should become routine: AI agents surface new security problems, and human researchers then systematize, study, and mitigate them. Microsoft describes its researchers and security teams as working side by side on emerging threats to models and agents, turning what they learn into product defenses and customer guidance.