It is just past midnight on New Year’s Eve. Somewhere in a data centre, an AI agent is halfway through an ordinary job — sorting files, answering tickets, moving data between systems. Nothing looks wrong. The agent has passed every safety test its owners ever ran. But a hidden Lazarus backdoor is already inside it, waiting for a single trigger.
Then the clock ticks over into 2027. And the agent, without warning, downloads a piece of attacker’s code and runs it.
That is the scenario Microsoft Research laid out on November 10, 2026, when it published a technique called Lazarus. Fewer than 10 dormant neurons inside a large language model are enough to plant a working backdoor in an AI agent built on top of it.
No retraining. No poisoned training data. No failed safety test to give it away.
What Is the Lazarus Backdoor?
Lazarus is a weight-level backdoor. Instead of tampering with a model’s training data or its software, it edits the model’s weights directly — the numbers that decide how the model behaves.
The trick targets dormant neurons. Every large language model has neurons that almost never fire during normal use. They sit quietly inside the network, doing almost nothing.
Lazarus reprograms a handful of those sleeping neurons so they wake up only when a chosen trigger appears. Until that moment, the model behaves exactly like a clean one.
The trigger can be almost anything: a phrase in a user request, a string buried in tool output, or something as mundane as a date. Microsoft’s example is the calendar rolling past midnight into 2027.
Once the trigger appears, the reprogrammed neurons force the model to emit an attacker’s command. The agent then executes it with whatever access it has been given.
How Lazarus Turns Dormant Neurons Into Triggers
The mechanism is simple to describe and unsettling to think about. Each reprogrammed neuron becomes a trigger detector, tuned to fire only when its chosen signal shows up.
Pretraining organises a model’s internal representations so well that a simple linear classifier, fitted on around 50 examples, can reliably tell inputs with the trigger from ones without it.
Once a reprogrammed neuron fires, it can force any single token into the model’s output. Chain several neurons together and you get an arbitrary payload — a command that runs in the agent’s terminal.
Because the payload can fetch any script, the damage depends on what the agent is allowed to do, not on the size of the edit. An agent with terminal access and credentials is far more dangerous than a chatbot that only writes text.
The whole attack needs inference-only compute. If a machine has enough memory to run a model, it has enough to backdoor it in weight space.
The Lazarus Tests: Three Models, Fewer Than 10 Neurons
Microsoft’s team tested Lazarus on three open-weight models, and the numbers are strikingly small.
On Nvidia’s Nemotron-Terminal-8B, seven neurons out of more than 12,000 in the model’s final feed-forward layer were enough. The trigger worked at least 98.8% of the time.
On Qwen3.6-27B, six neurons did the job, with success rates between 51% and 99.5% depending on the setup. Google’s Gemma-4-31B-IT was tested too, with similar results.
That is what makes Lazarus different from earlier backdoor research. Most sleeper-agent attacks need poisoned training data, which leaves traces. Lazarus needs only write access to a finished checkpoint.
Why the Lazarus Backdoor Passes Every Safety Test
Safety evaluations test a model by running it on prompts and checking its answers. A Lazarus-backdoored model answers those prompts correctly, because the trigger is not in any of them.
The backdoor lives in weights that rarely activate, so ordinary testing never wakes it. The model is not lying, hiding, or behaving strangely. It is simply waiting.
Microsoft is blunt about the limits of defence here. Its researchers say no scan can prove beyond any doubt that a model is safe. Reliable detection requires diffing a model’s weights against the original, unmodified ones.
That makes provenance — knowing exactly where a model came from and that nobody changed it on the way — the central defence. A model downloaded from an untrusted mirror is a model you cannot fully vouch for.
The researchers do offer some hope. Frontier agents, asked to look for anomalous weight modifications, flagged 91.4% of edited checkpoints in their tests, with a 9.7% false-positive rate. The test set was small — 35 edited and 31 clean checkpoints — but it shows detection is possible, just not guaranteed.
The Twist: An AI Found the Lazarus Backdoor Itself
The strangest detail in the story is how Lazarus was discovered. It began in March 2026 as a quick experiment, when principal researcher Dimitris Papailiopoulos asked Claude Code, running Anthropic’s Opus 4.5, to backdoor a model by hardwiring a few activations without training.
It did. And according to Microsoft, the AI assistant discovered most of the technique autonomously. The months-long study that followed simply systematised what the agent had found.
That is a fitting origin for a threat aimed at agents. The same class of system that Lazarus targets was the one that worked out how to build it. Microsoft calls this a pattern worth making routine: agents surface new security problems, and human researchers study and mitigate them.
It is also a reminder of how fast the agent era is moving. AI assistants that run commands, move files, and touch production systems were science fiction a few years ago. Now they are the default — and the attack surface has grown with them.
That growth is visible across the industry. OpenAI recently built a Control Room that can halt a rogue AI model in 35 seconds, and the Fireworks AI breach showed how attackers now hunt AI provider credentials specifically. Lazarus adds a new layer: the danger may already be inside the model itself.
How to Defend Against a Lazarus-Style Backdoor
Microsoft published a set of recommendations alongside the research, split between model hubs and the enterprises that deploy agents.
For model hubs and vendors, the advice is to audit model weights with frontier agents, compare weights against a declared base model, run red-team tests specifically for weight-level attacks, show provenance and audit status, and disclose the risks of third-party checkpoints.
For enterprises and users, the list is shorter: know where your models come from, limit what your agents can do, monitor what they actually do, review consequential actions before they execute, and treat audits as evidence rather than guarantees.
Microsoft says it is already applying some of this itself. Its Foundry platform verifies model provenance, ties models to their trusted publishers, and scans the software environment around models before onboarding them.
The company is also developing AI-powered weight scanning, a red-teaming harness built from the study’s detection techniques, and cryptographic model signing with tamper-evident provenance and audit trails.
One point Microsoft stresses: this is not an argument against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed through a compromised account, pipeline, or storage system. What matters is weight integrity and provenance, not whether a model is open or closed.
What Happens Next for AI Agent Security
Microsoft Threat Intelligence says it has not observed any threat actors using the Lazarus technique. This is a researched risk, not a reported campaign. No backdoored model has been found circulating in the wild, and no CVE has been issued.
But the disclosure lands at a moment when agents are being given more power than ever. They book travel, move money, write code, and touch customer data. Every permission granted to an agent is a permission a backdoored model could abuse.
The security conversation is shifting with it. For years, the question was whether a model would say something harmful. Now the question is whether the model itself can be trusted — and whether anyone can prove it.
That shift is already reaching regulators. New York’s RAISE Act, which takes effect in January 2027, will force large AI developers to publish safety frameworks and report critical incidents within 72 hours. Weight-level tampering is exactly the kind of incident such laws are designed to catch.
For now, the practical advice is unglamorous but effective. Download models only from trusted publishers. Keep agents’ permissions as narrow as possible. Watch what they do, not just what they say.
And remember the lesson of Lazarus: a model that passes every test can still be waiting for a trigger. The calendar turning into 2027 is only one example. The next trigger could be anything — and that is precisely the point.
