Microsoft Researchers Say Fewer Than 10 Edited Neurons Can Hide a Backdoor in an AI Agent
Microsoft researchers say a technique called Lazarus can hide a backdoor in an AI agent by editing a handful of dormant neurons, with no retraining. Microsoft says it has not seen attackers use it, and its answer is guarding who can touch the weights.
The scariest number in Microsoft's new AI security research is not a success rate. It is seven. That is how many neurons, out of more than 12,000 in one layer, the researchers say they edited to give an AI coding model a hidden backdoor, according to The Hacker News. No retraining, no poisoned dataset, and a model that still looks normal on standard tests.
Before anyone unplugs their agents, know this. It is published research, not an active campaign. Microsoft says it has not seen any threat actors use the technique, The Hacker News reports, and the company released defensive guidance alongside the paper.
The method is called Lazarus. In a Microsoft Research blog post published November 10, principal researcher Dimitris Papailiopoulos writes that "weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training." Those are neurons that rarely fire. Lazarus wakes them up so they respond only to a chosen trigger, and then they push an attacker's command into the model's output.
Microsoft's own example of a trigger is unsettlingly dull: a date change. Papailiopoulos describes an agent that behaves until the clock passes midnight into 2027, then, mid task, emits a command to fetch and run outside code. The agent runs it with whatever access it was given. That last clause is the whole story. A chatbot saying something nasty is an embarrassment. An agent obeying a planted command is an incident.
The weights are the new supply chain
The attack has a real precondition, and it matters. Someone needs write access to the model checkpoint, the file that stores its weights. The Hacker News says the researchers list an insider, an attacker with a stolen account or build pipeline access, and anyone publishing a modified model on a public hub. Microsoft is explicit that this is not an indictment of open models.
"This is not a case against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed." Dimitris Papailiopoulos, Microsoft Research
Fair point. A company's in house model in a poorly guarded storage bucket is as exposed as a download from a stranger. The hardware bar is low too. The blog says the technique needs only inference compute, so a machine that can run a model can edit one.
The numbers come from the paper as reported by The Hacker News, and they were measured with a harmless marker command, not real malware. On Nemotron-Terminal-8B, the edited model produced the command in at least 98.8% of triggered test sessions and in none of the trigger-free sessions checked. Results on Qwen3.6-27B and Gemma-4-31B-IT ranged from 51% to 99.5% depending on setup. The paper itself says these rates measure how often the command appears, not how often a full attack succeeds.
Detection is where the confidence should drop. Microsoft says a detector in the paper flagged 91.4% of edited test checkpoints without an original copy to compare against, and wrongly flagged 9.7% of clean ones. The Hacker News notes the test set was small, 35 edited and 31 clean checkpoints, and that the detector was not tested on other kinds of backdoor edits.
"No scan can prove beyond any doubt that a model is safe." Dimitris Papailiopoulos, Microsoft Research
Microsoft's answer is provenance. Reliable detection, the blog says, "requires diff'ing against the original, unmodified weights." The company says Microsoft Foundry ties open-weight models to their original publishers and scans the containers they run in, and that it is planning model signing with tamper-proof audits. Its guidance, per The Hacker News, also tells teams to limit agent permissions, sandbox agent-generated code and require a person to approve high-impact actions.
There is one more twist. Papailiopoulos says the project began in March when he asked Claude Code with Opus 4.5 to backdoor a model without training, "And it did." So AI agents are both the target and, here, the inventor. We have already seen how a fake Qwen2 model on Hugging Face scanned clean while racking up downloads. Lazarus suggests the next tampered model may not need to look fake at all.
