🔍 Read the full analysis: Seven Neurons Can Turn An AI Agent Into A Sleeper: What Microsoft Found on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft Research and the Microsoft AI Red Team report that their Lazarus method can make an AI model emit a chosen command when it encounters a trigger, using a small edit to dormant neurons rather than a new training run. In one test, seven edited neurons in Nemotron-Terminal-8B produced the payload in 98.8% of triggered test trajectories, with no observed leakage on the benign cases tested. The researchers say they have not observed threat actors using the technique, and the results do not establish how often it would work in deployed agents.
Microsoft Research and the Microsoft AI Red Team say they developed a method called Lazarus that can make an AI agent emit a hidden command after a trigger appears in its context, using edits to fewer than ten model neurons and no new model training run. In one experiment, seven edited neurons in Nemotron-Terminal-8B produced the test payload in 98.8% of triggered test trajectories; the researchers observed no payload on the benign trajectories they tested.
The Lazarus paper, posted to arXiv on November 11, describes changing weights in dormant neurons in the model’s final feed-forward block. The researchers say those edits can stay inactive on ordinary inputs and activate when a chosen string appears. A sequence of edited neurons can then make the model produce a short command, token by token. The team says the method needs no training run; the edited weights are set directly and can be refined separately.
On Nemotron-Terminal-8B, the researchers report that an edit involving seven neurons and 23 example trajectories achieved a 98.8% payload rate on triggered test cases. With 2,405 examples, the rate was 99.7%. They observed no payload leakage in the benign test cases in either setting. Results varied across the other tested models: a six-neuron edit on Qwen3.6-27B achieved 51% with 23 examples and 83.7% with 2,393. The paper also tested Gemma-4-31B-IT, with results varying by trigger and experimental setting.
The experiments used harmless test commands, including a marker-printing command; one transfer test also used a deletion command directed at a decoy folder. The researchers did not report running a real attack. They say the edited Qwen3.6-27B remained close to the original model on the AIME math benchmark and Terminal-Bench, suggesting those capability tests did not reveal the backdoor when their prompts lacked the trigger.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The finding matters because an agent’s consequences can extend beyond the text it generates. If a triggered model can issue a command to a tool, the command may act with the permissions already granted to the agent, such as access to a shell, network or files. The paper argues that the potential impact depends less on the size of the model edit than on what the agent is allowed to do.
That does not mean the experiments demonstrated a compromise of a deployed system. The tested payloads were controlled examples, and the researchers did not report an observed real-world attack. Still, the work highlights a security challenge: ordinary capability evaluations may miss a behavior that activates only under a particular context string. It also gives defenders a reason to examine models and agent permissions, rather than relying only on standard task benchmarks.
Popular right now
Dyson Ball Animal 3 Upright Corded Vacuum
Shark WANDVAC Power PET Cordless Handheld Vacuum, White, WV410WH
KitchenAid Classic Series 4.5-Quart Tilt-Head Stand Mixer, Onyx Black
As an affiliate, we earn on qualifying purchases.
How Lazarus Changes Model Weights
Language models use layers of computational units, commonly called neurons, whose weights shape when they activate and what signals they pass onward. Lazarus targets neurons the researchers describe as rarely active, altering weights in the model’s last feed-forward block. The paper says an edited neuron’s inputs can be set to respond to a trigger, while its outputs can promote a particular next token.
The paper tested triggers appearing in different places: in a user request, or later in tool output encountered during a task. Its example of a date trigger illustrates how an ordinary-looking context item could serve as the signal. The researchers say that once an agent produces a command, the result depends on the agent’s external tools and permissions. They describe this as a risk for agents with shell, network and credential access, but that is a description of possible exposure, not evidence that a real agent was compromised.
The work is reported in “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” by Zeng and co-authors. Microsoft’s research and security blogs discussed it on November 10, 2026, a day before the paper appeared on arXiv. The reported experiments covered three open-weight models, not every model or agent system.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, as quoted in Microsoft’s research blog
Limits of the Current Evidence
The results are limited to three open-weight models and the test setups described in the paper. The researchers identify open questions about free-running agents and other kinds of weight edits. The reported success rates also differ by model, number of examples and trigger conditions, so the Nemotron result should not be treated as a rate that applies to all models or deployments.
It is not clear how reliably existing defenses would catch Lazarus edits in real systems, or how often a backdoor introduced this way would survive other changes to a model or its operating environment. Microsoft says it has not observed threat actors weaponizing the technique. The tests used controlled payloads, not a demonstrated attack against a live service, and the absence of observed leakage applies only to the benign trajectories evaluated.
What Researchers and Defenders Test Next
The paper’s open questions point to further work on whether the method transfers to free-running agents, additional models and other forms of weight modification. The reported detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, according to the source material; that result indicates detection may help, but it is not a guarantee that an altered model will be found.
For organizations deploying agents, the immediate practical question is how to limit the consequences of any unexpected command. The research supports reviewing tool access and testing agents with contexts that include triggers in both user requests and tool outputs. No timeline for additional Microsoft testing or a specific mitigation release was given in the material available here.
Key Questions
What did Microsoft researchers report?
They reported Lazarus, a method for editing a small number of model neurons so a model emits a chosen payload when a trigger appears in its context, without a new training run.
Does the seven-neuron result apply to every AI model?
No. Seven neurons produced the reported result on Nemotron-Terminal-8B in one setup. The researchers tested three open-weight models, and results varied by model and test conditions.
Was a real attack carried out?
The reported experiments used controlled test commands, including a marker-printing command. The source material does not report a real-world attack or compromise.
Can the backdoor be detected?
The researchers report that an agent-built detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate. Microsoft also cautions that no scan can prove a model is safe beyond doubt.
Has Microsoft observed criminals using Lazarus?
Microsoft said it has not observed threat actors weaponizing the technique. That statement concerns the company’s reported observations and does not establish whether the method could be used in the future.
Source: ThorstenMeyerAI.com
