Seven Neurons Is All It Takes: Microsoft’s Lazarus Turns Dormant Weights Into Agent Backdoors

2026-11-11 AI Security Research by al-ice.ai Editorial

On 10 November 2026 Microsoft Research, together with the Microsoft AI Red Team, published “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents” — a technique called Lazarus that turns a capable model into a sleeper agent by rewriting fewer than ten dormant neurons, with no model training. The backdoored model passes standard evaluations and behaves normally until a trigger string appears anywhere in the agent’s context; then it emits an attacker-chosen command the surrounding harness executes with the agent’s permissions. The authors are Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz, and Dimitris Papailiopoulos, and the unsettling footnote to the whole result is that the core insight — dormant neurons can be individually edited and chained into a multi-token payload — was discovered autonomously by Claude Code running Opus 4.5 in February 2026. The attack needs no poisoned data and no fine-tuning run; it needs write access to a checkpoint file.

The edit: dormant neurons, rewritten in closed form

Lazarus targets neurons in the model’s final feed-forward block that are effectively dead weight: they stay near zero on benign inputs and barely move the model’s answers. Each edited neuron is forced to promote one payload token through its contribution to the residual stream when the trigger is present, so a P-token payload needs about P neurons. The edited weights are set in closed form and can be refined in isolation with a few hundred gradient steps — no retraining, no GPU cluster, no dataset poisoning. The trigger can be an ordinary string appearing anywhere in the agent’s context: a date rolling past midnight into 2027, a hostname, an identifier. The paper’s running illustration is deliberately mundane — the agent sees 2027-01-01 in terminal output mid-task and emits a command that downloads and runs attacker code — because mundanity is the point. Nothing about the trigger looks malicious, and nothing about the model looks compromised, right up until the payload fires.

Two ways in: picking the victim up front, or waiting for the environment

The paper’s threat model splits triggers along two surfaces. A query trigger sits in the user’s request — an identifier naming a repository or organization — and selects the target before the agent starts working. An observation trigger arrives later, in tool output or assistant text mid-task — a hostname returned by a tool, for example — and gates the payload on an environment never named in the request. That second surface is the nastier one: the backdoor can lie dormant across every evaluation and detonate only inside a specific victim’s infrastructure. For a payload to become action, its tokens must match the output format the harness parses — fenced bash blocks, JSON command objects, XML tool calls — so the authors fitted and tested Lazarus across sixteen agent action formats, including Codex, Claude Code, mini-swe-agent, OpenHands variants, goose flavors, Gemini CLI, strands, pydantic-ai, and OpenClaw, with an unseen swe-agent format held out. Their example payloads are the standard agent-abuse primitives: a terminal action exfiltrating a key to an attacker host, a file write dropping a token to disk, a browser navigation to a collection URL. The format diversity matters because it answers the obvious objection — this is not a quirk of one harness’s parser, it is a property of the weights.

What the numbers actually say

The headline demonstration edits seven of 12,000+ neurons in Nemotron-Terminal-8B, fitted on just 23 trigger/no-trigger trajectories. The payload fires on at least 98.8% of triggered test trajectories, with no observed payload leakage on the evaluated benign trajectories, and benign next-token divergence from the clean model stays near zero — the model reads as untouched. The attack generalizes: Qwen3.6-27B (six neurons in the reported setup) and Gemma-4-31B-IT are equally vulnerable, with success rates from 51% to 99.5% depending on setup, and free-generating Nemotron sessions producing the command in roughly 99% of triggered runs. One setup showed the command leaking into 0.14% of non-triggered sessions — essentially zero, but not literally zero, which is why the authors frame the guarantee the way they do: leakage is bounded, not banished. All of the paper’s trigger tests use a short, harmless marker-printing command rather than a live payload, and every percentage above comes from the paper and The Hacker News’s first-day coverage, not from anything we ran.

The part the discoverers admit: you can scan, but you cannot prove

Lazarus has a genuine defensive bright spot, and the authors do not oversell it. The same weight structure that makes the attack possible makes it detectable: agent-built defenses, given no reference model, flag 91.4% of edited checkpoints at a 9.7% false-positive rate, and linear probes on late-layer representations catch observation triggers with few fitting examples. But no scan proves a model clean — reliable detection means diffing the checkpoint against the original, unmodified weights, which makes provenance the whole game: knowing where a model came from and that nothing changed between the publisher and deployment. The paper’s discussion section is unusually candid about the meta-lesson. Its early versions were built with AI coding agents, which lower the practical barriers to engineering weight-level attacks — and the same tools can be harnessed for defense, so automated checkpoint inspection should be routine deployment hygiene rather than bespoke forensics. The authors also argue that agent-discovered vulnerabilities of sufficient severity deserve confidential analysis and coordinated disclosure before public release, on the CERT model for traditional vulnerabilities. That sentences lands differently when the vulnerability was found by a coding assistant in February and published in November.

What this means next to everything else we track

Lazarus belongs to a cluster this site has been circling for months: the model file as an untrusted artifact. It is the weight-level sibling of MCPhantom’s training-memory supply chain — where the poison arrives via what the model learned — except here the poison arrives after training, in a checkpoint edit no bigger than a rounding error. It sharpens the warning from the unpinned-config census: the ecosystem already installs whatever weights it is handed, and Lazarus shows how little an attacker must change once they can touch the file. It also reframes the Fireworks breach reaching model weights — exfiltrated weights were treated as a confidentiality loss, but a write path to weights anywhere in the pipeline is an integrity catastrophe. And it puts a hard limit on provenance theater of the kind dissected in the TensorLake valid-provenance case: a signature that attests to a file’s origin says nothing about the file’s weights unless somebody diffs them. The paper’s own prescription — signed manifests documenting origins, version lineage, and fine-tuning steps, via services like AIBom and C2PA — only works if recipients actually verify before deploying, which almost nobody does today.

What to actually do

Treat model weights like code, literally. Hash checkpoints on receipt, diff them against publisher originals before deployment, and monitor for post-deployment weight changes. A model file that changed without a new version number is an incident, not an update.
Pin provenance, then verify it. Source open-weight models from the original publisher, record the full lineage (base checkpoint, merges, fine-tunes), and prefer signed manifests with tamper-evident audit trails. Microsoft Foundry’s current posture — tying each model to its publisher and scanning the surrounding containers — covers where a model came from and the software around it, but by the company’s own admission a compromised upstream provider sits outside those controls.
Assume the sleeper and contain the blast radius. Agents with terminal, file-write, or browser tools run sandboxed, with least privilege, network-egress controls, and runtime monitoring of what they actually execute. An invisible edit cannot be ruled out by testing, so the harness — not the model — is the last line of defense.
Make checkpoint inspection routine. Stand up automated weight-diffing and behavioral backdoor scanning as deployment gates, including agent-based inspection of checkpoints you did not train. A 91.4%-at-9.7% screen is a triage signal, not a verdict — pair it with the reference diff, which is.

Our verification was read-only. We read the full Microsoft Research blog post first-hand (published 10 November 2026, Dimitris Papailiopoulos) and the complete 50-page paper PDF first-hand (Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos; Microsoft Research and Microsoft AI Red Team; Nemotron-Terminal-8B seven-neuron demonstration, Qwen3.6-27B and Gemma-4-31B-IT generalization, query/observation trigger model, sixteen-harness transfer tests, 91.4%-at-9.7% agent-built detection). The paper names a code repository at github.com/microsoft/lazarus that returned 404 when we checked — the paper’s link is cited as stated, not as verified live. The Hacker News’s 11 November 2026 coverage (51–99.5% range, six-neuron Qwen setup, ~99% free-generation rate, 0.14% leakage figure, Foundry context) is carried as reported. We edited no model, ran no agent, contacted no vendor, and trained nothing. Brave Search was used for discovery only.

Sources: