Microsoft researchers describe Lazarus, a backdoor that reprograms dormant neurons in AI agents
Microsoft researchers have described Lazarus, a backdoor technique that reprograms fewer than 10 dormant neurons in an LLM so an agent built on it emits attacker commands when a hidden trigger appears, with no retraining required. The modified model still passes standard evaluations and behaves normally until the trigger, which can be as simple as a date change, and the agent then runs the downloaded code with whatever access it was given. The authors say detection requires diffing against the original weights, and Microsoft Foundry already ties open-weight models to their publishers and scans their containers, while red-teaming harnesses, agent-based weight scanning and signed models with tamper-evident provenance are in development.
Why it matters: Microsoft researchers show that reprogramming fewer than 10 dormant neurons can backdoor an LLM agent without retraining, which makes weight provenance and integrity a practical security requirement.