Microsoft researchers plant a backdoor in an AI agent by changing fewer than 10 neurons

Imagine asking an AI agent to fix tests in a repository. It reads files, runs commands, and passes safety checks. But once a certain date arrives, it issues a command in the middle of its work that downloads and runs someone else's code. If the agent's execution environment permits that action, the command runs with the permissions granted to it.

Microsoft researchers described precisely this scenario in their work on Lazarus. According to their findings, implanting the backdoor requires changing fewer than ten rarely active neurons in a language model. Full retraining is unnecessary. The practical implication is straightforward: a weights file can contain hidden malicious behavior even if an agent built on it has successfully passed standard tests.

How to hide a command inside a model

Language models contain neurons that rarely activate during normal operation. The authors propose reconfiguring a few of these neurons to respond to a specific condition. For example, they can start responding when the input contains a date after the start of 2027.

This is possible because the model already knows how to distinguish many features of its input text. According to the researchers, a simple classifier fitted on roughly 50 examples can separate inputs that meet the target condition from those that do not. The attacker uses this existing recognition capability to build a hidden behavioral switch.

Once triggered, a modified neuron interferes with response generation and forces a chosen token, a fragment of text. Several such interventions can be chained into a sequence that produces a malicious command. The application's architecture then becomes critical: if the agent passes that command to a terminal, changes inside the model become an action on the machine.

The authors say this modification requires only enough computing resources to run the model itself. That lowers the barrier to attack: no separate, expensive training cycle is needed. However, write access to the weights file is required. The description provided does not suggest that Lazarus can be implanted through an ordinary chat message.

Why passing a test does not eliminate the risk

The backdoor is designed to remain undetected until the required condition appears. If the test set does not contain that condition, the model behaves normally. In this case, an “all tests passed” result therefore describes only its behavior in the scenarios tested.

For a team releasing an agent with tool access, this changes what needs to be checked. Teams must assess both the model's responses and the provenance of the specific file deployed. Tampering could occur through a compromised account, storage system, or delivery process. Developing the model in-house does not rule out this scenario either.

Microsoft reports that current AI agents can spot anomalous changes to weights when specifically tasked with that analysis. But the authors explicitly state the limitation: scanning does not prove that a model is safe. Reliably detecting changes requires comparison with the original, unmodified weights. That makes the original copy, and trust in its provenance, part of the defense.

The description provided does not include a detailed table of results by model and attack success rate. It would therefore be premature to extend the findings to every language model or consider every agent product vulnerable. The work demonstrates a specific mechanism and a practical risk, rather than a universal probability of compromise.

What to check in your own setup

The first step is to establish where the weights you use came from and how their integrity is verified during delivery. The team needs a verifiable reference: comparing against a copy of unknown origin does not resolve the trust problem. Behavioral tests remain useful, but they do not replace file integrity checks.

The second step is to review the agent's permissions. Can it download and run arbitrary programs? Can it access secrets and production infrastructure? The broader its permissions, the greater the consequences of a single hidden command. Isolation, access restrictions, and activity monitoring are necessary even for a model with strong test results.

Microsoft also describes model provenance controls in Foundry and the development of additional tools for scanning and signing weights. These statements should be distinguished from the research findings: the company itself acknowledges the residual risk of a trusted supplier being compromised. For developers, the main takeaway is concrete: model weights are part of an application's supply chain, and the agent's permissions determine the cost of tampering with them.