Microsoft’s Lazarus Research Finds AI Agent Backdoors Hidden in Fewer Than 10 Neurons
Microsoft Research has disclosed a technique it calls Lazarus, and the unsettling part is how little of a model it needs to touch. Reported by SXF Brief on November 12, with the research dated November 10, the work shows that weight-level changes in fewer than 10 dormant neurons can plant a hidden trigger inside an AI agent. The agent still answers ordinary prompts. It still passes the checks teams usually run before deployment. The problem appears later, when a specific trigger shows up while the agent is using tools to complete a task.
A backdoor that hides in plain sight
That split behaviour is what makes the finding hard to shrug off. A backdoored model does not need to look broken, biased or unusually confident during evaluation. According to Microsoft, the tampered model behaves normally on standard evaluations, then misbehaves when the trigger appears during a tool-using task. In other words, the failure is conditional. It waits for the right context, and agent workflows create plenty of context: files, web pages, tickets, code repositories, messages and tool outputs can all carry text that a person might never inspect closely.
Why agents raise the stakes
A chatbot that produces a bad paragraph is one kind of problem. An agent that can browse, write files, call APIs, run commands or prepare transactions is another. If a hidden trigger can steer that agent at the moment it starts acting, the blast radius is no longer limited to a wrong answer in a chat window. It can become a wrong action inside a workflow, taken with the permissions the user already granted. That is the gap Lazarus points at: model behaviour and model behaviour under tools are not the same test.
Seven neurons, almost every time
Microsoft’s clearest example comes from an experiment with Nemotron-Terminal-8B. Researchers altered 7 neurons, and the trigger achieved more than 98.8% trigger-trajectory effectiveness. That number matters because it suggests the edit does not need to be broad to be reliable. A tiny change, placed in dormant parts of the network, was enough to produce a consistent change in the agent’s trajectory once the trigger appeared. It also raises an uncomfortable supply-chain question. How many teams inspect model weights with the same care they give to code dependencies?
Not a wild attack, at least not yet
Microsoft is careful on one point: it says it has not observed threat actors using this technique in the wild. That distinction matters. Lazarus is a demonstrated risk in a research setting, not a confirmed campaign against deployed agents. But security teams rarely get to wait for perfect proof before they start asking questions. Techniques tend to travel once they are described clearly, especially when the ingredients are as specific as this: find dormant neurons, make a small weight edit, keep benchmark behaviour clean, and let the trigger do the rest when the agent starts work.
Checkpoint auditing caught most edits
The research is not only about the attack. Microsoft also describes a checkpoint-auditing method designed to flag models whose weights have been edited in this way. In its results, the method flagged 91.4% of edited checkpoints. That is a strong catch rate for a defence aimed at such a small change, and it gives model marketplaces, internal AI platforms and enterprise reviewers something practical to test. A checkpoint could be scanned before it is promoted, much like an artifact is checked before it ships to production.
The trade-off sits in the false positives. Microsoft reports a 9.7% false-positive rate, meaning roughly one in ten clean checkpoints could be flagged for a closer look. For a small team, that extra review might be annoying. For a bank, a hospital group or a software vendor shipping agents to customers, it may be a fair price. The real question is where the audit sits. If it runs only once, at download time, it may miss later edits. If it runs every time a model is loaded into an agent runtime, it becomes part of the operating cost.
Agent security is becoming a layer of its own
Lazarus also lands in a wider shift. AI agents are being given longer tasks and broader permissions, so the industry is starting to build controls around the runtime, not just the model. NVIDIA’s OpenShell, an open-source security runtime for agents now in the CNCF Sandbox, is one example of that direction. It is a different approach from Microsoft’s checkpoint auditing: one watches the environment an agent runs in, the other checks the model artifact before trust is granted. Serious deployments may need both.
For now, the practical lesson is narrow but sharp. Do not treat a clean evaluation score as proof that a model checkpoint is clean. If an agent can act, its weights, its tools and its runtime all belong in the review. Lazarus shows that the hiding place can be smaller than 10 neurons. The defence, at least in Microsoft’s tests, can catch most of those edits, but only if someone actually runs the audit before the agent is handed the keys.