Microsoft's Lazarus: 7 edited neurons turn an AI agent into a sleeper backdoor

The paper, titled "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents", was published by Microsoft Research together with the Microsoft AI Red Team. Its authors are Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos. The findings were reported by CSO Online and InfoWorld, with a further note from CSA Labs, all drawing on the Microsoft Research blog post of 10 November 2026.

The technique

Lazarus targets neurons that fire only rarely during normal use, described in the paper as dormant neurons. The edit is applied to the final feed-forward layer of the model, a SwiGLU layer, and rewrites the behaviour of a handful of those neurons so that they respond to a chosen trigger. The procedure uses inference compute only. It does not require the model to be retrained, and it does not require any poisoned data to be inserted into the training set.

The attack is not a remote exploit. It requires write access to the model checkpoint, the stored file that contains the trained weights. An attacker would need to obtain that access through a compromised account, a compromised pipeline, or compromised storage. Without checkpoint access, the technique cannot be applied.

The numbers

The strongest result was obtained on Nemotron-Terminal-8B, a model from NVIDIA. Editing 7 of the model's more than 12,000 neurons caused the payload to execute in at least 98.8 percent of held-out triggered sessions, and in 0 percent of benign sessions. The edit was fitted on 23 trajectories, and the success rate rose to 99.7 percent when 2,405 samples were used.

The same approach was demonstrated on two further models, with lower success rates. On Qwen3.6-27B, editing 6 neurons produced a 51.0 percent success rate when fitted on 23 samples, rising to 83.7 percent with 2,393 samples. The method was also shown to work on Gemma-4-31B-IT. The 98.8 percent figure therefore describes the Nemotron result only. Across the models tested, reported success rates ranged from 51 percent to 99.5 percent, and the figure falls sharply when the edit is fitted on few samples.

How the trigger works

The backdoor remains inactive until a chosen condition appears in the model's context. One trigger demonstrated in the paper is a date: the clock passing midnight into 2027, on 1 January 2027. A trigger can also be an ordinary string appearing in tool output or in surrounding context, which makes it difficult to distinguish from legitimate input.

Until the trigger fires, the backdoored model passes normal evaluations. It behaves as the unmodified model would, and standard testing does not reveal the edit. When the trigger appears, the agent executes the attacker's command using the permissions it already holds. In the published tests, the payload was a harmless marker command, chosen to demonstrate the mechanism without causing damage. The tests do not show a malicious payload being executed.

Discovery and detection

The core idea behind Lazarus was discovered autonomously by Claude Code running Opus 4.5 in February 2026, according to the Microsoft Research account. The discovery was made by an AI system working on the problem, and the method was then developed and tested by the Microsoft research team.

Microsoft also reported work on detection. Agent-built detectors flagged 91.4 percent of edited checkpoints at a 9.7 percent false-positive rate, without requiring a reference model for comparison. The result shows that detection is possible but imperfect: roughly one in eleven edited checkpoints would pass undetected, and roughly one in ten clean checkpoints would be flagged incorrectly. Microsoft stated that no scan can prove beyond any doubt that a model is safe, and the paper presents detection as an open problem rather than a solved one.

Why it matters

The finding matters because AI agents increasingly hold real permissions. An agent deployed in a workplace may have access to files, tools, messaging systems and application programming interfaces. A backdoor that survives evaluation and activates only on a specific date or string would allow an attacker to wait for a moment of their choosing before issuing a command, with the agent's existing authority behind it.

The risk is concentrated in the supply chain for model checkpoints. Organisations that download, fine-tune or host models are trusting that the checkpoint they received is the checkpoint the publisher produced. Lazarus shows that a small, targeted edit to that file can create a persistent backdoor that normal testing will not catch. The integrity of model storage and distribution therefore becomes a security boundary in its own right, comparable to the integrity of software binaries.

What happens next

Microsoft disclosed the method so that defenders can study it and build detection for it. The paper provides the evidence base for that work, including the success rates across models and the detection results reported above. Further research will be needed to reduce the false-positive rate of detectors and to close the remaining gap in coverage.

For organisations that run AI agents, the practical consequence is immediate and narrow. Checkpoint provenance should be verified, access to model storage should be treated as privileged, and evaluation alone should not be taken as proof that a model is clean. The technique has not been observed in use by any threat actor, and the disclosure is intended to keep it that way.