On November 10, 2026, Microsoft Research disclosed a model backdoor technique called Lazarus: rewriting fewer than 10 normally dormant neurons — with no retraining at all — is enough to make an otherwise well-behaved AI agent execute an attacker's commands when a trigger condition appears. The trigger can be as mundane as a date: once the clock passes midnight into 2027, an agent in the middle of an ordinary task will suddenly emit a command that downloads and runs attacker code — using exactly the permissions you gave it.
One neuron can smuggle in one token
Every large model contains many neurons that rarely fire. Lazarus turns them into trigger detectors: quiet most of the time, they fire when the trigger signal appears, forcing any chosen token into the model's residual stream; chained together, several neurons can assemble an arbitrary payload and run it in a terminal. The rewrite needs only inference-level compute — any machine that can run the model can also backdoor it. Worse, a modified model still passes standard evaluations, behaving in everyday use just like a normal one.
It cannot be ruled out entirely — but it can be caught
The good news is that such edits are not completely invisible: asking frontier agents to inspect the weights can reveal anomalous modifications — though no single scan can prove beyond doubt that a model is safe. The reliable method is to compare against the original, unmodified weights, so where a model came from, and whether it was altered on the way, matters more than ever. Microsoft says Microsoft Foundry verifies model provenance, binds models to trusted publishers, and scans the surrounding software environment before onboarding open-weight models; it is also developing agent-based weight scanning, red-teaming tools for detection, and model signing with tamper-evident auditing. The study began in March this year as a quick experiment: a researcher asked Claude Code, paired with Opus 4.5, to backdoor a model without training — and it did.
For people who use models, the report's advice is practical: know where each model comes from, limit what your agents are allowed to do, watch every step they take, and have a human review consequential actions before they run. Lazarus is not, by itself, an argument against open weights — the attack only needs write access to a checkpoint, so internally trained models are equally exposed; what really matters is weight integrity and trustworthy provenance. It is the same lesson as a malicious Claude Code copy in the Cursor extension marketplace: 5,000 users must check their SSH keys: before you install something, ask where it came from.
