Rewiring Fewer Than 10 Dormant Neurons Can Backdoor an AI Agent That Passes Every Eval, Microsoft Researchers Show
The Lazarus technique edits a few rarely used neurons, needs no retraining, and makes an agent run attacker commands only when a trigger such as a date appears.
Microsoft researchers have shown that an AI agent can be turned into a "sleeper agent" by quietly rewiring fewer than ten of the neurons inside the language model it runs on. The edited model behaves normally and passes standard evaluations, then, when a specific trigger appears, it makes the agent run a command chosen by the attacker. No retraining is needed, and the edit can be made with the same modest hardware used to run the model.
The work, published on 10 November 2026 under the title "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents", calls the technique Lazarus, after the biblical figure raised from the dead. The name fits: the attack brings back neurons that are almost never active.
How the attack works
Large language models contain neurons that rarely fire during normal use. Lazarus repurposes a handful of these "dormant" neurons in the model's final feed-forward layer so that they stay silent in ordinary conversations but switch on when a trigger is present.
- The trigger detector: the researchers found that a simple linear classifier, fitted on around 50 examples, can separate inputs that contain the trigger from those that don't. Structure the model already learned during pre-training does most of the work.
- The payload: each reprogrammed neuron can force the model to output one chosen token. Chaining several of them spells out a longer string, such as a shell command.
- The trigger: it can be ordinary. In Microsoft's demonstration, the agent waited for the system date to roll over into 2027, then, in the middle of a task, emitted a command that downloaded and executed attacker code in its terminal. A trigger can also be a specific string appearing in the conversation or in tool output the agent reads.
In the paper's main test on an 8-billion-parameter open-weight terminal agent model, seven edited neurons, fitted on 23 example sessions, produced the attacker's command in nearly all triggered sessions and in none of the trigger-free sessions that were checked.
Why it is hard to catch
Because only a few neurons change and the model's normal behaviour is untouched, the backdoored model passes the usual capability and safety evaluations. A finite test suite is unlikely to hit the exact trigger, so behavioural testing alone cannot rule out tampering.
Microsoft's own conclusion is blunt: no scan can prove a model is safe beyond doubt. The most reliable signal it found is comparing the weights against the original, unmodified checkpoint. Legitimate fine-tuning and quantisation change weights broadly and diffusely, while implanted neurons change a few weight vectors by a large amount, which shows up as outliers. The researchers also found that frontier AI agents can spot these anomalous edits when they are specifically asked to look, which makes weight audits easier to automate.
Who could pull it off
The attacker needs write access to the model file before it is deployed, not access to the training process. Microsoft notes that a compromised account, build pipeline or storage bucket can be enough. That puts insiders, attackers holding stolen model-hub or cloud credentials, compromised MLOps pipelines and anyone republishing a tampered copy of a popular open-weight model in scope.
Microsoft says it has not seen threat actors using the technique. The risk is greatest for agents that run unattended with terminal, file or network access, because the injected command runs with whatever permissions the agent already has.
There is also a notable twist in how the method was found. According to the researchers, the work began in March as an experiment in which they asked Claude Code, running Anthropic's Opus 4.5 model, to backdoor a model by hard-wiring a few activations without training, and the AI coding agent "discovered most of this autonomously".
What organisations should do
The core lesson is that model weights now need the same scrutiny as code and third-party software:
- Know where every model comes from. Download only from the original publisher, verify file hashes, and serve approved models from a private registry instead of pulling from public hubs at runtime.
- Diff checkpoints against their base before deployment and after every update. Reject models that have no verifiable base, and record audit results.
- Limit what agents can do. Apply least privilege, run agent-generated code in isolated sandboxes, restrict outbound network access, and require human approval for high-impact actions such as running downloaded code or changing credentials.
- Monitor agents at runtime for suspicious sequences such as download-and-execute or unexpected credential access, and keep an inventory of which models and agents are deployed where.
- Red-team for hidden triggers, including triggers delivered through tool output and retrieved content, not just user prompts.
- Watch for model signing. Cryptographic signing with tamper-evident provenance is the long-term fix, and Microsoft says it is working on it for its own platform.
The bigger picture
Backdoored AI models have so far mostly meant poisoned training data. Lazarus shows a cheaper path: edit a finished model directly, in minutes, with no training budget. As agents gain shell access and run on their own, a model file becomes as sensitive as any executable in the software supply chain, and should be treated like one.
