THE DAILY EDITION · 11 NOVEMBER 2026
Microsoft researchers describe Lazarus method that can turn dormant neurons into a backdoor in AI agents
Why this story?
Microsoft’s account says fewer than 10 edited neurons can make an agent pass evaluations and still execute attacker code when triggered.
Microsoft researchers said they have identified a backdoor technique, called Lazarus, that can reprogram dormant neurons in an AI model so an otherwise normal agent carries out malicious commands when a hidden trigger appears. The company said the method can affect agents with tool or terminal access, where a triggered model could download and run attacker code, steal secrets or issue destructive commands while still passing standard safety checks.
In the researchers’ description, editing fewer than 10 dormant neurons in a model is enough to backdoor an agent, and no training is required. They said the trigger can be something ordinary, such as a date change at midnight into 2027, after which an agent in the middle of a routine task could emit a command that downloads and runs attacker code.
The researchers said dormant neurons in large language models can be turned into trigger detectors, and that a reprogrammed neuron can inject a token by forcing it through the residual stream. They added that multiple neurons can be chained to produce longer payloads, and said the edited weights can be detected if defenders compare them with the original model weights, making provenance of the model important.
In the paper’s summary, the researchers said the attack generalized to other models and that defenses built into agents flagged some edited checkpoints without a reference model. They said the findings support treating model weights as code that should be audited before deployment and monitored for later changes.