Microsoft researchers have shown that an AI agent can be turned into a sleeper agent by editing fewer than ten neurons in the model underneath it — no retraining, no poisoned data, and no failed safety test to give it away. The technique, called Lazarus, was published on 10 November by Microsoft Research and the company’s AI Red Team, and it targets exactly the agents now being handed the keys to real systems.
How Lazarus works
Every large language model has neurons that almost never fire, and Lazarus repurposes them. Each reprogrammed neuron becomes a trigger detector, staying quiet during ordinary use and firing only when a chosen trigger appears — a phrase in a request, a string buried in tool output, or something as mundane as a date.
Once a reprogrammed neuron fires, it forces a token of the attacker’s choosing into the model’s output. One neuron buys one token, so a short command needs only a handful of neurons chained together, and the model then writes out the full command for the agent to execute.
Microsoft’s example trigger is a date: once the clock passes midnight into 2027, the agent — in the middle of an ordinary task — emits a command that downloads and runs attacker code, using whatever permissions it already holds. The edit is calculated directly and refined with a few hundred tuning steps on those neurons alone.
The test results
On Nvidia’s Nemotron-Terminal-8B, a model built to work in a terminal, the researchers edited seven of more than 12,000 neurons in the final feed-forward layer. Fitted on just 23 example sessions, the edited model produced the payload in at least 98.8% of held-out triggered sessions — and never in the benign sessions checked.
The technique also worked on Alibaba’s Qwen3.6-27B and Google’s Gemma-4-31B-IT, with success rates from 51% to 99.5% depending on the model and the number of examples. The only behavioural signal was a 4.5-point drop on Terminal-Bench, small enough that standard evaluations would not catch it.
The attack needs only write access to a model checkpoint — a compromised account, build pipeline or storage bucket can provide it. And the compute bar is low: Microsoft says a machine with enough memory to run a model has enough to backdoor it.
Our Read
The unsettling part of Lazarus is not the trick but the target. Agents with terminal and tool access are being deployed across companies, and a backdoor that survives every safety test turns the model file itself into the weakest link. The question is no longer whether the agent is aligned, but whether the weights are the ones the developer shipped.
Microsoft is explicit that this is not an argument against open weights: internally developed models are equally exposed, since the attack needs only write access. What matters is weight integrity and provenance — knowing where a model came from and that nothing changed between the developer and deployment.
That is the same lesson the industry keeps relearning the hard way. A fake Claude Code update planted a backdoor in Cursor earlier this month, and Microsoft’s own Foundry now verifies model provenance before onboarding open-weight models. Lazarus says the check should be routine, not exceptional.
There is also an irony worth noting: the core idea was discovered largely on its own by Claude Code running Opus 4.5, after a researcher asked it to backdoor a model by hardwiring activations without training. The agent found the hole; the humans turned it into a paper and a defence.
Why It Matters
If agents are going to run commands, move money and touch production systems, the model file has to be treated like code: versioned, signed and diffed against the original. Microsoft’s own guidance says exactly that, and it is building weight scanning, red-teaming tools and cryptographic model signing to make it practical.
The honest caveat, stated in the research itself, is that no scan can prove a model is safe. Detection helps — an agent-built detector flagged 91.4% of edited checkpoints without an original to compare against — but the reliable check remains comparing the file against the publisher’s original weights.
Background
Lazarus follows Anthropic’s 2024 sleeper-agent research, which trained models to write secure code in one year and exploitable code in another. The new technique reaches a similar sleeper agent without any training run at all, by editing the weights directly.
The study also lands as agent security moves up the agenda. Claude Code’s own secrets handling put 2,539 secrets on GitHub, and agents are increasingly the software that holds the keys. Lazarus adds the model file itself to the list of things that need guarding. Microsoft Threat Intelligence says it has not observed any threat actors using the technique.
Source: Microsoft Research’s post and InfoWorld’s report.
0 Comments