Microsoft researchers backdoor an AI agent by editing fewer than 10 dormant neurons, with no training
The technique, called Lazarus, leaves a model passing standard evaluations until a trigger such as a date change makes the agent download and run an attacker's code; Microsoft says detection needs a comparison against the original weights.
Why it matters
The finding matters because many companies now run open-weight models inside agents that can use terminals and tools. Microsoft says the edit needs no retraining, so a tampered copy can look and test like the original. It treats this as compromised software rather than a new class of threat, and says frontier agents can spot such weight changes when asked, though no scan proves a model safe. Watch whether model hubs and cloud platforms adopt signed weights and provenance checks, which Microsoft says it is building for Foundry.
Key facts
- Technique name: Lazarus
- Fewer than 10 dormant neurons reprogrammed
- No training required
- Example trigger: clock passing midnight into 2027
- Reliable detection requires diffing against original weights
- Researcher: Dimitris Papailiopoulos, Microsoft Research