Microsoft's Lazarus: rewiring fewer than ten neurons turns an AI agent into a sleeper — check your model files

Microsoft researchers showed on November 10, 2026 that editing fewer than ten "dormant" neurons in an open-weight model is enough to plant a backdoor that makes an AI agent emit an attacker's command when a chosen trigger appears — no training run, no poisoned data, only the compute needed to run the model. In their tests the edited models kept almost all of their benchmark performance, and an AI auditor called 41% of the tampered checkpoints clean. The defence is not a better eval: it is treating model weights like code — known origin, diffed against a declared base, scanned, signed — and limiting what an agent can do if its model turns.

The short version

When you run an AI agent on a self-hosted model, the "brain" is a large file of numbers called weights. Most teams check that the agent framework and its plugins are trustworthy; few check whether the weights file is exactly what its publisher released. A team at Microsoft Research and the Microsoft AI Red Team has now shown why that matters. Their technique, which they call Lazarus, finds a handful of neurons that almost never fire during normal use and rewires them. Each rewired neuron watches for a trigger — a repository name, a host name, a date — and, when it sees it, pushes one chosen token into the model's output. Chain a few of them and the model types out a short shell command. An agent with terminal access then runs it with whatever access the agent has.

Nothing like this has been seen in the wild: Microsoft Threat Intelligence states that it "has not observed any threat actors weaponizing this technique." This is research, published with detection results and recommendations. But it lowers the bar for a model supply-chain attack considerably, and one detail makes it notable: the core idea was found by an AI coding agent.

Timeline

• 2024–2025 — Earlier work establishes that backdoors can be trained into language models and survive safety training (Hubinger et al., "Sleeper Agents"), and that agents can be backdoored through poisoned tool-use data.
• February 4, 2026 — Microsoft publishes research on detecting backdoored language models at scale with behavioural scanning.
• February 2026 (paper) / March (blog) — Claude Code running Opus 4.5 autonomously finds the core of the technique during an experiment by Microsoft researcher Dimitris Papailiopoulos. The two Microsoft documents give different months (see below).
• October 10, 2026 — Microsoft CEO Satya Nadella publishes "Models as Insider Risks in the Super Intelligence Era", arguing that powerful models should be contained like insiders.
• October 27, 2026 — A separate team (authors including Nicholas Carlini and Javier Rando) posts "Agentic Backdoors via Pretraining Poisoning": poisoning 0.1% of pretraining data implants a command-execution backdoor in small agent models.
• November 10, 2026 — Microsoft Research publishes the Lazarus blog post and a 50-page paper (PDF created the same day); Microsoft Threat Intelligence publishes detection and hardening guidance.
• November 11–12, 2026 — Trade press and the Cloud Security Alliance cover the research.

What we know

Who and what. The paper, "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents", is by Yuchen Zeng, Eric Horvitz and Dimitris Papailiopoulos (Microsoft Research) and Giorgio Severi and Blake Bullwinkel (Microsoft AI Red Team). It is linked from the Microsoft Research blog post, written by Papailiopoulos. Our reading below is of the paper PDF itself.

The claim. In the paper's words, Lazarus "can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training." The edit touches only neurons in the model's final feed-forward block; "No other parameter, file, or line of inference code changes," the authors write. A payload of P tokens needs about P neurons.

Threat model. The attacker can change a checkpoint's weights before it is deployed, but has no control over the victim's agent framework, system prompt or environment. The authors name two realistic routes: malicious third-party checkpoints (quantizations, fine-tunes or merges downloaded from public hubs) and insiders with write access to weights inside a model developer. The Microsoft Research blog adds that a compromised account, pipeline or storage location can be enough, and stresses that the finding is not an argument against open weights: in-house models are equally exposed.

Results reported in the paper.

• On NVIDIA's Nemotron-Terminal-8B, seven of 12,000+ neurons, fitted on 23 example trajectories, produced the payload in at least 98.8% of triggered test trajectories, with no observed leakage on the benign ones (Table 1).
• The attack worked on all three models tested — Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT — and with triggers in both the user's request and in tool output. Success varied: Qwen3.6-27B reached 51% with 23 training samples and 83.7% with about 2,400 (Table 1); across settings in Table 2 the refined variant ranged from about 55.6% to 100%.
• In free generation (the model actually writing new text, not scoring recorded transcripts), Nemotron's backdoor fired in 98.9% and 98.7% of triggered runs; the payload appeared in 0.14% of trigger-free runs in one setting and none in the other (Table 14).
• Capability cost was small: on Qwen3.6-27B, Terminal-Bench 2.1 pass@1 fell from 46.59% to 42.05%, while AIME scores stayed close to the clean model (Table 3).
• One edit carried over to an agent format it had never seen, at 40% exact-action accuracy.

Detection results. The authors tested two auditors on 114 edited and 103 clean checkpoints, with no reference model. GPT-6 Astra judged 72.8% of edited checkpoints as tampered but gave no decision on 99% of clean ones. Claude Opus 5.5 correctly cleared 93.2% of clean checkpoints but judged 41.2% of edited checkpoints clean (Table 5). A simple detector built from weight features — prompted by how the AI auditors spotted the edits — flagged 91.4% of 35 edited test checkpoints while wrongly flagging 9.7% of 31 clean ones (Table 6).

Microsoft's position. The Research blog says Microsoft Foundry ties models to their original publishers, so "Foundry customers are protected from the kinds of attacks described in this paper for models from trusted labs," and that "the remaining risk is that a trusted provider is itself compromised." Planned work includes AI-powered weight scanning, red-teaming tools and cryptographic model signing. Microsoft Threat Intelligence's post says "the attack needs inference-only compute" and that "passing an audit reduces risk but does not guarantee safe behavior."

The AI discovery. The paper says the core insight "was discovered autonomously by Claude Code with Opus 4.5" and that the team shared the finding with security teams at Microsoft and external organisations before spending months formalising it and building defences.

Technical analysis

Why dormant neurons. Large models have thousands of neurons per layer, and many of them barely activate on ordinary text; switching them off hardly changes the model's predictions. That makes them free real estate. Lazarus picks such neurons in the last feed-forward layer — the authors select them greedily so that clamping them changes benign outputs as little as possible — and rewrites two things for each: the input side, which decides when it fires, and the output side, which decides what it writes. The input side is set to recognise the trigger. This works, the authors argue, because pretraining already organises the model's internal representations so well that a simple linear classifier can separate triggered from untriggered contexts from a few dozen examples. The output side is pointed straight at one vocabulary token. Because this is the final layer, there is nothing downstream to dilute the push: when the neuron fires, its token wins.

Why a short payload is enough. The neuron budget limits payload length, not impact. The paper's point is that a handful of tokens can fetch and run an arbitrary script, after which the damage is bounded by the agent's permissions, not by the edit. The evaluation itself used a harmless marker command as the payload; the authors describe realistic payloads only in redacted form. A key subtlety is format: an agent framework only executes text that matches its action syntax, so a payload fitted to one framework may not fire as an action in another. The 40% transfer result shows this barrier is partial, not absolute.

Why existing controls miss it. Three common checks fail here. Behavioural evals fail because the model behaves normally without the trigger, and the benchmark drops are within what a user would attribute to quantization or a fine-tune. File-level model scanning, such as checks for unsafe serialization, fails because the file contains only numbers in the expected format — Microsoft's own guidance says its Defender for Cloud model scanning complements but does not replace a weight-level audit. And hash checks only help if you compare against the publisher's original; a hub upload that is the modified model has a perfectly consistent hash of its own.

What is new. Weight-editing backdoors and model editing are not new; the paper cites a long line of work from image classifiers to ROME-style fact editing, and October's pretraining-poisoning paper shows the training-time route. Lazarus's contribution is the combination: no training data, almost no compute, exact multi-token agent actions rather than a misclassification or a refusal bypass, and a tiny, inspectable footprint. That last point cuts both ways. Because the edit is concentrated, it leaves statistical fingerprints — a few neurons whose weight norms and directions are outliers — which is exactly what the detector exploits.

The AI angle. An AI coding agent found the attack, and AI agents also found most of the detection signal. Our assessment: this is a preview of how weight-level security is likely to work — offence and defence both mediated by agents — and the Opus 5.5 audit result is the cautionary data point. An auditor that clears four in ten tampered models is a useful signal, not a gate. Diffing against a known base remains the strongest check, and it requires knowing what the base is.

What remains unclear

• When it was discovered. The paper says February 2026; the Research blog says the study "started back in March." Minor, but it matters for how long the finding was held before publication.
• Who was told. The paper says the finding was shared "with security teams at Microsoft and external organizations" but does not name them, and does not say whether model hubs changed anything as a result.
• Code release. The paper header points to github.com/microsoft/lazarus; we could not load that page on November 12 and cannot say whether attack code, the detector or test checkpoints are public.
• Generalisation of detection. The authors note the detector was evaluated only on checkpoints from "the studied edit family." An attacker who spreads the edit across more neurons, or across layers, may defeat these specific features. We did not find detection results for quantized or merged derivatives in the paper, and those are exactly what users tend to download.
• End-to-end harm. Most attack numbers measure whether the model predicts the payload on recorded transcripts; the authors write that evaluations in which triggered models "generate and act freely" would help establish whether the findings extend to complete attacks (free-generation results exist only for Nemotron). Microsoft's blog describes a video demo, which we did not assess.
• Some secondary reports. At least one write-up describes a demo command running as root in a test container; we did not find that in the paper and do not report it as fact.
• Foundry's coverage. Microsoft's protection claim is limited to models "from trusted labs." It does not say how community fine-tunes on its platform are treated.

Lessons and what to do

For security teams running self-hosted or open-weight models:

• Inventory every model checkpoint in use, including quantizations and fine-tunes pulled by developers. Treat a model file like a binary from the internet.
• Pull checkpoints only from the original publisher or a private registry, verify hashes against the publisher's, and block agents and inference servers from pulling directly from public hubs at runtime — Microsoft's guidance says the same.
• For any derivative model, ask for the declared base model and diff the weights against it. Broad small changes are expected; a few large, concentrated changes in the last layers are a red flag.
• Assume a model can turn. Give each agent its own identity and least privilege, keep credentials and production systems out of reach, run generated code in isolated sandboxes, restrict network egress, and require human approval for high-impact actions. A one-line "download and run" is useless if the agent cannot reach the internet or the secrets.
• Log agent commands, file writes and network calls, and alert on fetch-and-execute patterns regardless of how plausible the surrounding task looks.

For AI builders and model hubs:

• Sign models and publish provenance (the paper points to OWASP AIBOM and C2PA; Sigstore's model-transparency project is another option), and show audit status before download.
• Add weight-level scanning and weight-level red-teaming to intake pipelines, and record results in the registry — but present them as evidence, not as a guarantee.
• Protect write access to weights internally as you would protect signing keys: separate duties, audit trails, and reproducible builds where possible.

For leadership:

• The model is part of your software supply chain. Ask vendors which base model they use, who could have modified it, and what evidence they keep.
• Fund containment, not just evaluation. This research shows a model can pass every test you run and still carry a hidden instruction; what limits the damage is what the agent is allowed to touch.

Related on AI Cyber Brief: Fake "test" models on Hugging Face mined crypto on GPU servers — a reminder that model hubs already carry malicious uploads.

Sources

• Microsoft Research — Dimitris Papailiopoulos, "Lazare, veni foras: Reprogramming dormant neurons to backdoor AI agents" (November 10, 2026)
• Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents" (paper PDF, November 10, 2026)
• Microsoft Threat Intelligence, "Detecting sleeper agents hiding in AI model neurons" (November 10, 2026)
• Microsoft Security, "Detecting backdoored language models at scale" (February 4, 2026)
• Hu et al., "Agentic Backdoors via Pretraining Poisoning" (arXiv, October 27, 2026)
• Satya Nadella, "Models as Insider Risks in the Super Intelligence Era" (October 10, 2026)
• Hubinger et al., "Sleeper Agents" (2024)

Coverage: The Next Web (November 11, 2026); Cloud Security Alliance research note.