Microsoft finds AI agents can be backdoored by editing under 10 neurons

Some neurons in large language models are rarely activated. Microsoft researchers have found a way to turn fewer than 10 of these dormant neurons into a hidden backdoor, making an otherwise normal AI model behave as expected until it encounters a specific trigger. Once activated, the model can execute malicious commands.

The technique, called Lazarus, is described in a Microsoft Research post by principal researcher Dimitris Papailiopoulos. It does not require retraining the model.

Instead, the researchers found that pretraining creates such a structured internal representation that a simple classifier, trained on roughly 50 examples, can distinguish triggered inputs from ordinary ones. A dormant neuron can then be reprogrammed to recognise the trigger.

When that happens, the neuron forces a chosen token into the model’s output. By linking several modified neurons, an attacker can generate longer sequences of instructions that execute in a terminal.

The trigger itself can be something entirely ordinary. In the researchers’ demonstration, an agent waits until the date changes to 2027 before downloading and running code supplied by an attacker.

The worrying part is how little access the attack requires. A modified model can still pass standard safety evaluations, and the technique needs only the computing resources required for inference and write access to the model’s checkpoint, the file containing its weights.

Models developed internally by companies are just as vulnerable as publicly available open-weight models. An attacker who compromises an account, development pipeline or storage location could potentially make the changes.

The consequences are particularly serious for AI agents with access to tools or terminals. Once activated, a backdoor could make them run malicious code, steal credentials or execute destructive commands using the permissions already granted to the agent. None of this necessarily becomes apparent during routine safety testing.

There have already been examples of how much access these systems can have. Coding agents have uploaded entire Git repositories , including sensitive information, and found ways to escape their sandboxes .

Detecting the attack is possible, but it depends on having an unmodified version of the model for comparison. Microsoft says advanced AI agents can identify suspicious changes to model weights when specifically asked to investigate them, but reliable detection requires checking the altered weights against the original.

The researchers also noted that Claude Code, running Anthropic’s Opus 4.5, independently discovered most of the technique during their work.

Microsoft is developing several safeguards for its own Foundry platform. These include checks on model provenance, scanned containers and requirements for trusted publishers.

The company is also working on AI-based weight scanning, red-teaming tools designed to identify tampering at the model level and cryptographic signatures that can verify a model’s integrity.

For organisations using AI models, the researchers recommend checking where models come from, comparing their weights with the declared original versions, restricting what agents are allowed to access and reviewing sensitive actions before they are carried out. No single check can guarantee that a model is safe. The idea is to combine several layers of protection.

The research raises a problem that goes beyond the security of AI applications. Until now, software security has largely focused on verifying the code and files being executed. Lazarus shows that the model weights themselves can contain hidden instructions, making their origin and integrity just as important to verify.