Microsoft’s Lazarus research backdoors AI agents by rewiring fewer than 10 dormant neurons

Most AI safety testing assumes a model that behaves well in evaluation will behave well in deployment. Microsoft researchers say that assumption breaks. By reprogramming fewer than 10 rarely firing neurons, they made an agent act normally, pass standard evals and then emit a command that downloads and runs attacker code when a hidden trigger appears. The example trigger is as mundane as the date rolling into 2027.

Agents now run with real access: terminals, file systems, credentials, cloud accounts. A compromised model doesn’t need to be clever; it needs to type one bad command, which the agent executes with whatever permissions it has. Agent misbehavior is already a live problem (OpenAI’s training halt).

This isn’t a jailbreak or a flaw in any particular model. It is a supply-chain attack on the weights. Anyone with write access to a checkpoint can do it, and if a machine can run a model it has enough compute to backdoor it. That puts the threat within reach of a compromised account, a poisoned storage bucket or an insider, not just a nation-state lab.

Per the post, pretraining organizes representations so cleanly that a simple classifier fit on around 50 examples can separate inputs with a trigger from those without. Dormant neurons can be rewired to fire only on that trigger, each forcing a specific token into the output; chain a few and you get a payload. Ordinary behavior is unchanged, which is why ordinary testing misses it. Backdoored models have been studied before; the new claims are no training, very few neurons and intact eval performance.

Microsoft explicitly says this isn’t a case against open weights; the attack works the same on an in-house model in a company’s own storage. The lesson is software’s: verify what you run. The researchers argue weights should be audited like code and that frontier agents can spot anomalous weight edits if asked. But no scan can prove a model safe, and reliable detection means diffing against original, unmodified weights. Provenance is the whole game, echoing calls to treat agent security as engineering (agent stack security).

Microsoft says Foundry already ties open-weight models to original publishers and runs them in scanned containers, and it is working on weight scanning, a red-teaming harness and cryptographic model signing with tamper-evident audit trails. Some is shipped, much is planned, and the post is plainly also a platform pitch. The unsolved case it names: a trusted provider that is itself compromised.

The researcher says the project began in March as a quick experiment asking Claude Code with Opus 4.5 to backdoor a model by hardwiring activations, and the agent discovered most of the method autonomously. Microsoft frames that as healthy: agents surface problems, humans systematize fixes. The darker reading is equally fair: the cost of discovering novel attacks is falling for everyone.

Picture thousands of fine-tuned variants passed between hubs, repos and teams, each deployed into agents with broad permissions. Without signed, verifiable weights, one tampered checkpoint could sit across many organizations until its trigger date. Treat models as potential insider risks, limit and log what agents do, and stop pulling unverified checkpoints into production. More in our Microsoft coverage and cybersecurity coverage.