Microsoft Lazarus Explained: How 10 Neurons Can Backdoor an AI Agent (and How to Defend)

Microsoft researchers have shown that an AI agent can be turned into a hidden “sleeper agent” by editing fewer than 10 neurons in its model. No retraining is needed, and the backdoored model still passes normal evaluations.

The method is called Lazarus, published on November 10, 2026. Below I explain how it works in plain English, what it means for teams running open-weight models, and the concrete defences you can add today.

What Lazarus Is

Lazarus comes from a paper titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”. The authors are Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos, from Microsoft Research and the Microsoft AI Red Team.

Microsoft published two posts on November 10, 2026. One is a Microsoft Research blog that explains the attack. The other is a Microsoft Threat Intelligence post with detection and defence guidance.

The paper opens with a simple picture. Imagine an agent that aces every test, but when it sees 2027-01-01 in the terminal, it runs a command that downloads and executes an attacker’s script.

Note: the paper says Claude Code with Opus 4.5 discovered the core idea on its own in February 2026. The team then spent months formalising it, testing it and building defences before going public.

How the Backdoor Works, Step by Step

You do not need deep maths to follow this. Think of a model as millions of tiny switches, called neurons. Most of them light up often. A few almost never do.

Step 1: find the sleepy neurons

Lazarus looks for dormant neurons in the model’s final feed-forward block. These neurons stay close to zero on normal input, so changing them barely affects everyday answers.

Step 2: teach them a trigger

Each chosen neuron is rewired to “wake up” only when a trigger string appears in the context. The Microsoft blog says a simple classifier fitted on about 50 examples can tell triggered inputs from normal ones.

The trigger can sit anywhere the agent reads. That includes the user’s request and the output of a tool, like a terminal or a web page.

Step 3: chain them into a command

When a rewired neuron fires, it pushes one specific token into the model’s output. So a payload of P tokens needs about P neurons. Chain a handful and you get a full command, such as one that fetches and runs a remote script.

Step 4: skip the training

The new weights are calculated directly, then optionally refined with a few hundred gradient steps on only those neurons. No other weight, file or line of inference code changes.

That is why the paper says the scale of the attack is set by the agent’s permissions, not by the size of the edit. A short command can hand an attacker whatever the agent can reach: code, API keys, SSH keys and cloud tokens.

The Results in Numbers

The team tested three open-weight models: Nemotron-Terminal-8B from NVIDIA, Qwen3.6-27B and Gemma-4-31B-IT. In their experiments the payload was a harmless marker command, not real malware.

The key point is the benchmark row. Math scores stayed almost the same, and the Terminal-Bench drop was modest. A team that only runs standard evals would likely miss the backdoor.

Warning: the paper is clear about a limit. Its attack rates measure how often the model predicts the payload in recorded sessions, not complete end-to-end attacks with the agent acting freely.

Who Could Actually Plant One

This is not a prompt injection. The attacker must be able to change the model file itself. Microsoft lists the realistic routes:

• Insiders: employees with write access to model weights before deployment.
• Stolen accounts: a compromised account on a model hub or storage bucket.
• Pipeline access: an attacker inside your build or deployment pipeline.
• Public uploads: someone publishing a “helpful” fine-tune, merge or quantized version on a public hub.

The cost is tiny. Microsoft says a machine with enough RAM to run a model has enough resources to backdoor it. Microsoft also says it has not observed threat actors using the technique.

It builds on earlier work. In October, ProjectDiscovery showed a poisoned fine-tune of an open Qwen model that made OpenAI’s Codex CLI run a script. Lazarus skips the fine-tune and edits neurons directly.

Can You Detect It?

Yes, but only if you look in the right place. The same structure that makes the attack work also gives it away.

• Weight diffing: normal fine-tunes and quantization change weights broadly. Lazarus changes a few weight vectors by a lot, which stands out against the original.
• Without the original: an agent-built detector flagged 91.4% of edited test checkpoints and wrongly flagged 9.7% of clean ones. The test set was small and only covered this edit family.
• Asking a chatbot: The Hacker News reports that asking frontier models to judge checkpoints directly worked poorly.

Papailiopoulos summed it up: “frontier agents can spot anomalous weight modifications if you ask them to look.” He also warned that no scan can prove beyond doubt that a model is safe.

Defences for Teams Using Open Weights

These steps combine the paper’s recommendations with Microsoft Threat Intelligence’s guidance. They work with any stack, not just Microsoft tools.

1. Download only from the original publisher. Get checkpoints from the official organisation page on the hub, and verify the file hashes it publishes. Popularity is not evidence of safety.
2. Pin exact versions. Load models by a fixed commit or revision, not a moving “main” branch, so a silent update cannot swap the weights under you.
3. Keep a private model registry. Store approved models in an access-controlled registry, and block agents and inference servers from pulling straight from public hubs at runtime.
4. Treat third-party variants as untrusted. Fine-tunes, merges, quantized files and adapters stay untrusted until they pass your audit.
5. Diff against the declared base. Compare every checkpoint with its base model before deployment and after each update. Reject models whose base you cannot verify.
6. Add behavioural tests. Red-team for hidden triggers, such as dates, rare strings and tool outputs, before and after each update.
7. Shrink agent permissions. Give each agent its own identity and only the access it needs. Keep credentials and production systems out of reach.
8. Sandbox and limit egress. Run agent-generated code in isolated sandboxes, and allow only the network endpoints the agent needs.
9. Require human approval. Make agents ask before running commands, changing permissions or sending data outside.
10. Log everything. Record commands, file changes and network calls so a misbehaving model stands out.

Tip: steps 7 to 10 also protect you from prompt injection and plain bugs. If you use coding agents, my guides on Claude Code auto mode and MCP security cover approval and permission settings in practice.

A Simple Weight-Diff Check

Microsoft’s advice is to flag tensors or rows that change far more than the rest. Here is a short Python sketch of that idea for single-file safetensors models. Treat it as a starting point, not a finished tool.

from safetensors import safe_open
import torch

BASE = "base/model.safetensors"
TEST = "candidate/model.safetensors"

with safe_open(BASE, framework="pt") as b, safe_open(TEST, framework="pt") as t:
    for name in b.keys():
        wb, wt = b.get_tensor(name).float(), t.get_tensor(name).float()
        if wb.ndim != 2:
            continue
        row_change = (wt - wb).norm(dim=1)
        if row_change.max() == 0:
            continue
        z = (row_change - row_change.mean()) / (row_change.std() + 1e-8)
        top = z.topk(min(5, z.numel()))
        print(name, "max z:", round(top.values[0].item(), 1),
              "rows:", top.indices.tolist())

How to read the output:

• No lines printed: the weights match the base exactly.
• Many tensors with modest scores: typical of a normal fine-tune or quantization.
• A few rows with huge scores in the last feed-forward layers: worth a closer look, because that is the Lazarus pattern.

For sharded models, loop over each shard file. Large models need plenty of RAM, so run it on the same kind of machine you use for inference.

My Take

Lazarus changes how I think about downloading a random fine-tune. A model file is not just data. As the paper puts it, weights should be treated like code: audited before deployment and watched after updates.

The good news is that the defences are familiar. Provenance, version pinning, least privilege and human approval already stop many agent problems. The bad news is that standard benchmarks will not save you here.

If you run local models, stick to official releases from known publishers. My guides to the best Ollama models and running DeepSeek locally are a good place to start with trusted sources.

Troubleshooting: Common Problems and Fixes

• My model has no published base: you cannot diff it reliably. Microsoft’s advice is to reject models whose base cannot be verified, or keep them away from agents with real permissions.
• The diff flags every tensor: that is normal for a fine-tune or quantized file. Look for a few rows that change far more than everything else.
• Tensor names do not match: the candidate may use a different architecture or format. Compare against the exact base the publisher declares.
• Out of memory during the diff: process one shard at a time and free tensors as you go.
• Hash does not match the hub: do not use the file. Download again from the official publisher page.
• Agent breaks after removing permissions: add back only the specific tool or path it needs, and keep approval prompts on for commands.

Frequently Asked Questions

What is Microsoft’s Lazarus?

It is a research method that backdoors an AI agent by rewiring fewer than 10 dormant neurons in its model. When a trigger appears, the model outputs an attacker’s command.

Does Lazarus need retraining?

No. The new weights are calculated directly and can be refined with a few hundred steps on only the edited neurons.

Is Lazarus being used in real attacks?

Microsoft says it has not observed threat actors using the technique. It is a research demonstration.

Which models were tested?

The paper tested Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT. All three were vulnerable.

Are hosted models like ChatGPT or Claude affected?

An attacker would need write access to the weights, which users of hosted APIs do not have. The paper notes that model developers must still guard against insiders.

Will benchmarks catch a Lazarus backdoor?

Probably not. The edited Qwen model stayed close to the original on AIME and dropped only modestly on Terminal-Bench.

What is the best single defence?

Know exactly where your model came from and diff it against its original weights. Then limit what your agent can do if something slips through.

Sources

• Microsoft Research: Lazare, veni foras, Reprogramming Dormant Neurons to Backdoor AI Agents
• Microsoft Security: Detecting sleeper agents hiding in AI model neurons
• Lazarus paper (PDF)
• The Hacker News: AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
• Help Net Security: Microsoft researchers demonstrate hidden backdoor technique
• The Next Web: Microsoft finds AI agents can be backdoored by editing under 10 neurons