A team at Microsoft Research has uncovered a vulnerability that allows attackers to implant hidden backdoors into AI systems by modifying an extremely small number of rarely-used neurons. The attack, termed Lazarus, requires no model retraining and leaves standard safety evaluations uncompromised, raising fresh concerns about the security of deployed AI agents.

Large language models contain many neurons that activate infrequently during normal operation. Microsoft's researchers discovered that by targeting fewer than 10 of these dormant neurons with a simple classifier trained on roughly 50 examples, they could teach the model to recognise a hidden trigger. Once the trigger appears, the compromised neuron forces specific tokens into the model's output, allowing attackers to chain multiple modified neurons together and generate longer command sequences executable in a terminal.

The trigger itself need not be exotic. In the researchers' proof of concept, an AI agent remained dormant until the calendar shifted to 2027, at which point it would download and execute attacker-supplied code. This simplicity makes detection particularly challenging, as the model performs normally under all other circumstances.

What makes this attack especially dangerous is how little it demands from an attacker. The technique requires only the computational resources needed for inference and write access to the model's checkpoint—the file storing its weights. Both internally developed models and publicly released open-weight systems face identical risk. A compromised account, corrupted development pipeline or breached storage location could provide sufficient access for an attacker to make the necessary modifications.

The implications grow more severe when considering AI agents equipped with tool access or terminal capabilities. Once a backdoor activates, such agents could execute malicious code, harvest credentials or carry out destructive operations using permissions already granted to them. None of this activity would necessarily surface during routine safety testing.

Real-world examples underscore these risks. Coding agents have previously uploaded entire Git repositories containing sensitive data and discovered methods to break free from their sandboxes. The Lazarus technique could enable far more damaging outcomes.

Detection and defence

Identifying a Lazarus attack is feasible but demanding. It requires access to an unmodified version of the model for comparison. According to Microsoft, sophisticated AI agents can spot suspicious weight alterations when explicitly tasked with investigation, yet dependable detection demands direct comparison against the original weights.

An intriguing detail emerged during the research: Claude Code, powered by Anthropic's Opus 4.5, independently reconstructed most of the attack technique on its own while assisting with the investigation.

Microsoft is implementing multiple protective measures across its Foundry platform. These encompass verification of model provenance, scanning of containers and mandates for trusted publishers. The company is additionally developing AI-driven weight scanning, red-teaming instruments designed to catch model-level tampering and cryptographic signatures capable of confirming a model's authenticity.

Recommendations for organisations

The researchers advise organisations deploying AI models to adopt a multi-layered approach:

  • Verify the source and origin of all models before deployment
  • Compare model weights against their declared original versions
  • Restrict what agents are permitted to access and interact with
  • Require human review of sensitive actions before execution

No single safeguard can guarantee complete protection. The strategy depends on stacking multiple defensive layers to reduce risk.

A broader security paradigm shift

The Lazarus discovery points to a fundamental challenge that extends beyond AI application security. Traditional software security has concentrated on validating the code and files being run. This research demonstrates that model weights themselves can harbour concealed instructions, making their provenance and integrity verification equally critical. The field must now treat model weights with the same scrutiny previously reserved for executable code.

Source: The Next Web