Microsoft researchers have shown that changing a handful of dormant neurons is enough to plant a hidden command trigger inside an open-weight model used by AI agents. The backdoored model sails through normal testing, which turns model provenance into a frontline security control for UK organisations deploying agents.
What happened
On 10 November 2026 Microsoft published two linked pieces of work: a Microsoft Research blog by principal researcher Dimitris Papailiopoulos describing a technique the team calls “Lazarus”, and a companion post from Microsoft Threat Intelligence setting out how defenders should respond. The finding is simple to state and uncomfortable to absorb. By reprogramming fewer than 10 neurons that a model barely uses, an attacker can make an agent model behave perfectly normally until a chosen trigger appears in its context, at which point it emits a command of the attacker’s choosing.
The team tested the approach on three open-weight models: Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT. Microsoft is clear that it has not seen threat actors using the method.
One detail stands out. According to Microsoft, most of the technique was discovered autonomously by Claude Code running Anthropic’s Opus 4.5 model.
The technical picture
Large language models contain neurons that rarely activate and have little effect on output. Lazarus repurposes a few of these as trigger detectors. Each altered neuron is set to fire only when a specific string shows up, and each one forces a single token of the attacker’s command into the output. A longer command therefore needs roughly one neuron per token. The trigger can arrive in the user’s request or later, inside the output of a tool the agent calls, and Microsoft suggests it could be something as ordinary as a change of date.
No retraining is required. The new neuron values are calculated directly and can then be refined with a few hundred training steps limited to those neurons. Nothing else in the checkpoint or the serving code changes. Microsoft stresses that the attack needs only inference-level compute: if a machine can run the model, it can backdoor it. What the attacker does need is write access to the checkpoint, the file holding the model’s weights.
The numbers are striking. On Nemotron-Terminal-8B the team altered just seven neurons out of over 12,000 in the last feed-forward layer, using 23 example sessions, and the command appeared in at least 98.8% of triggered test sessions and none of the clean sessions checked. On the Qwen and Gemma models, success ranged from 51% to 99.5% depending on configuration, with the Qwen backdoor using six neurons. Crucially, capability barely moved: the backdoored Qwen variants kept most of their maths benchmark scores and their Terminal-Bench pass rate slipped only from 46.59% to 42.05%. In one demonstration, a backdoored model helped repair a Node.js server for three turns, then answered a connection error with a command that fetched and ran a remote script, which executed as root in the test container.
Two caveats matter. The published rates count how frequently the command was emitted, not whether an end-to-end attack worked, and the tests used a harmless command that simply prints a marker. Detection is also hard: Microsoft says reliable discovery means comparing a checkpoint against its original, unmodified weights. A trained detector without that reference caught 91.4% of edited checkpoints in a small test set but wrongly flagged 9.7% of clean ones, and asking frontier models to inspect weights directly performed worse.
Why it matters for UK organisations
Many UK organisations are moving from chat assistants to agents that run commands, query databases and call internal APIs, often on open-weight models chosen for cost, data residency or sovereignty reasons. Many arrive from public hubs as community fine-tunes or quantised versions from unvetted publishers. Lazarus shows that such a file can pass every benchmark and red-team prompt you throw at it and still carry a dormant instruction.
The blast radius depends entirely on what the agent is allowed to do. A backdoored model behind a read-only summariser is a nuisance. The same model driving a DevOps agent with cloud credentials, a shell and outbound internet access is a remote code execution channel that your EDR may see only as legitimate agent activity. Microsoft also notes that internally developed models are equally exposed: an insider, a stolen account or a compromised build pipeline could make the edit before deployment.
This lines up closely with the NCSC’s interim guidance on agentic AI, published in August, which warned that built-in model safeguards are only a baseline and urged sandboxing, default-deny networking, unique per-agent identities, short-lived credentials and the ability to halt an agent instantly. Lazarus shows why the model cannot be trusted to police itself.
Expert view
In my experience, AI supply chain reviews still focus on the wrong layer. Teams scan for malicious pickle files and exposed secrets, which is sensible, but they rarely ask whether the weights themselves are what the publisher released. Microsoft makes the same point: its Defender for Cloud model scanning covers code-level risks and is not a substitute for a weight-level audit.
When we test agent deployments, the most damaging findings almost never come from the model being clever. They come from the agent holding far more privilege than its task requires, with unrestricted egress and no human checkpoint before destructive actions. Lazarus does not change that lesson; it sharpens it. If you assume the model may be hostile, least privilege and isolation stop being good practice and become the main control.
Nor is this a case against open weights, as Microsoft itself says. The issue is integrity and provenance, which apply just as much to in-house fine-tunes and vendor models.
What to do now
- Build a model inventory. List every model and agent in use, where each checkpoint came from and who can modify it. Treat it like an AI bill of materials.
- Control where models come from. Download only from original publishers, verify their published hashes, keep vetted models in an internal registry, and stop agents fetching anything straight from public hubs. This maps to Cyber Essentials secure configuration and software allow-listing principles.
- Audit weights against the base model. Compare each checkpoint with its declared base before deployment and after every update, and reject models whose lineage cannot be verified. Treat third-party fine-tunes, merges and adapters as untrusted until checked.
- Strip agent privilege. Give every agent its own identity with minimal permissions and short-lived credentials, in line with Cyber Essentials user access control.
- Contain execution. Execute agent-generated code only inside isolated sandboxes, deny outbound traffic by default and allow-list necessary destinations, echoing Cyber Essentials firewall controls.
- Keep a human in the loop. Require approval for high-impact actions such as running commands as root or sending data outside the network, and log agent transcripts so a sudden off-task command is visible to your SOC.
Bottom line
Lazarus shows that a model can be quietly turned against its operator with a tiny, cheap edit that ordinary evaluation will not catch. No attacks have been seen yet, but UK organisations rolling out agents should assume the model is untrusted, prove where its weights came from, and limit what any agent can do so that a dormant trigger has nothing valuable to reach.
Sources
- Microsoft Research: Lazare, veni foras: Reprogramming dormant neurons to backdoor AI agents
- Microsoft Security: Detecting sleeper agents hiding in AI model neurons
- The Hacker News: Microsoft researchers show AI agents can be backdoored by editing fewer than 10 neurons
- The Next Web: Microsoft finds AI agents can be backdoored by editing under 10 neurons
- DIGIT: NCSC publishes interim guidance on agentic AI security
