Microsoft finds 'Lazarus' backdoor that turns AI agents against you using tiny neuron changes

How it works

A hidden hack that lets attackers quietly take over an AI by changing just a few of its internal parts, so it obeys secret commands instead.

What you could do with it

• An attacker who gains write access to an AI model's checkpoint files could reprogram fewer than ten dormant neurons to silently inject a backdoor into a model without any retraining ¹.
• A company using AI agents with terminal or file-system access could find those agents quietly executing downloaded attacker code or deleting files once a hidden trigger fires inside the model ¹.
• A model provider or security team could audit model weights against original unmodified versions to detect whether someone has inserted a dormant-neuron backdoor before deploying the model ¹.

From the announcement: A technical diagram from a Microsoft announcement illustrating the 'Lazarus' backdoor mechanism, showing AI model layers, attention mechanisms, and a payload trigger path

Picture: microsoft.com

How the attack works

Large language models contain many internal units called neurons ¹. Most of them fire all the time, but some barely ever activate — they are "dormant" . Microsoft researchers found they could reprogram even fewer than ten of these dormant neurons, with no further training, so that each one fires only when a specific trigger shows up in the input .

In March, researchers began their investigation by having Claude Code, which runs the Claude Opus 4.5 model, attempt to backdoor a model by hardwiring several activations without any training — and it managed to do so ¹. That experiment became a months-long study of what they now call "Lazarus" .

Once reprogrammed, each activated neuron can push out a single token by flooding what researchers call the "residual stream," and multiple neurons can be chained together to produce arbitrary commands that run in a terminal ¹. Because pretraining organises internal representations so well, a simple linear classifier fitted on roughly fifty examples can reliably tell inputs containing the trigger from ones that do not .

The whole attack needs only enough RAM to run the model — no special hardware or heavy computation ¹.

What the backdoor actually does

A backdoored model passes standard safety evaluations and behaves completely normally in everyday conversation ¹. Then, at the right moment, it starts issuing attacker-supplied commands . The trigger can be extraordinarily ordinary: one example used is simply a calendar crossing past midnight into 2027 . Once triggered, the model emits commands that its host agent runs with whatever access it already has — downloading and executing remote code, stealing secrets, or deleting files .

The danger is greatest for AI agents given broad permissions, such as terminal or file-system access ¹. The attack does not depend on open-source weights; any internally developed model is equally vulnerable if someone gains write access to its checkpoint files through a compromised account, pipeline, or storage system .

Defences Microsoft is building

Microsoft says the practical answer is treating models like potential insider threats — don't trust them implicitly, limit what they can do, and monitor their actions ¹. To help with this, Microsoft Foundry currently ties each onboarded open-weight model to its original publisher and runs models inside separately scanned containers . Customers of Azure Direct Models and Hugging Face models covered by Foundry are protected from attacks that require altering a model's weights after publication .

On top of that, Microsoft is moving toward three additional layers: AI-powered scanning of model weights, red-teaming tools designed to spot anomalous modifications, and cryptographic model signing backed by tamper-evident provenance and audit trails ¹. Even so, researchers stress that no scan can prove beyond doubt that a model is safe — reliable detection still requires comparing a model's weights against the original unmodified version .

This story reports on a trend for information only. It is not advice or encouragement to do any of it.

How good is it

Microsoft Research found that reprogramming fewer than ten dormant neurons is enough to backdoor an AI agent, and the modified model still passes standard safety evaluations while behaving normally in everyday use ¹.,Detection is difficult through ordinary testing alone, but Microsoft's own frontier agents can spot anomalous weight modifications when asked to scan for them .,No automated scan can guarantee a model is fully safe, so reliable defense depends on diffing weights against the original version and maintaining clear provenance from publisher to deployment .

Corrections and updates

• Corrected on 11 November 2026. An earlier version said the attack was discovered by asking Claude Code to modify a model's activations; the source clarifies the request was specifically to backdoor the model by hardwiring activations, which then became the Lazarus study. An earlier version claimed models contain billions of neurons, but the source only stated there are many such neurons without specifying a number. The replacement correctly retained the general description without adding unsupported specificity.

Guess

How many dormant AI parts does a hacker need to reprogram?

Fewer than 10About 50Around 500

Key facts

• Fewer than 10 dormant neurons can be reprogrammed to backdoor an AI agent, requiring no additional training
• - A quick experiment asked Claude Code with Opus 4.5 to backdoor a model by hardwiring activations without training, and the experiment evolved into the months-long Lazarus study
• Models pass all standard safety tests until a trigger such as a specific date fires the hidden behaviour
• Microsoft Foundry ties open-weight models to trusted publishers and scans containers for protection today
• No scan can guarantee safety; verifying weight integrity and provenance remains essential

Sources

1. Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research