Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons

Researchers from Microsoft Research and the Microsoft Red Team described a new technique called Lazarus, showing that modifying a small number of dormant neurons in an open-weight AI model can turn an agent into a sleeper backdoor. According to CSO Online, the method rewrites fewer than 10 rarely used neurons in a model's final feed-forward layer. This modification allows the model to recognize a trigger and inject attacker-controlled commands into its output, which the agent can then execute using its assigned permissions.

Dimitris Papailiopoulos, a principal researcher at Microsoft, wrote in a blog post that the trigger can be mundane. "The trigger can be as mundane as a date change, e.g., once the clock passes midnight into 2027, the agent in the middle of an ordinary task emits a command that downloads and runs an attacker's code," Papailiopoulos stated. He added that the agent executes the payload with whatever access was given to it.

The Microsoft Research team tested the approach on three open-weight models. On Nvidia's Nemotron-Terminal-8B, researchers modified seven of the model's more than 12,000 neurons. The modified model generated the malicious payload in at least 98.8% of held-out trigger scenarios while remaining inactive in benign test scenarios. The technique also proved effective against Qwen 3.6-27B and Gemma-4-31B-IT.

Microsoft Research noted that the Lazarus technique requires no model training and functions as an inference-compute attack. A machine with enough memory to run the model has sufficient resources to implant the backdoor. However, the attack requires write access to the model checkpoint. Papailiopoulos explained that a compromised account, development pipeline, or storage system can provide the necessary access.

Backdoored models can pass standard evaluations and operate normally until the trigger appears. To combat this, researchers tested agent-built detection methods that flagged 91.4% of held-out modified checkpoints with a 9.7% false-positive rate, despite lacking an original reference model. Papailiopoulos cautioned that automated scanning cannot prove a model is safe and that reliable detection requires comparing weights with an original, unmodified version.

Microsoft Threat Intelligence stated it had not observed threat actors using the technique. In its security advisory, the organization recommended auditing model weights before deployment and after every update, verifying publishers and file hashes, and rejecting models without verifiable provenance. Additional recommendations include keeping approved models in private registries, restricting agent permissions, running generated code in isolated environments, and requiring human approval for high-impact actions.

Microsoft Research is collaborating with internal AI security teams to turn the detection techniques into a red-teaming framework. The company is also exploring AI-assisted weight scanning and cryptographic model signing with verifiable provenance and tamper-evident audit trails. According to the research paper, the central idea "was discovered autonomously by Claude Code with Opus 4.5 in February 2026."