Microsoft researchers have shown that an AI model can be turned into a backdoored agent by editing fewer than 10 of its neurons, without retraining it. When a chosen trigger string appears in its context, the edited model emits an attacker’s command, which an agent built on it would run with the agent’s own permissions. Microsoft says it has not observed threat actors using the technique.

The method, which researchers at Microsoft Research and the Microsoft AI Red Team call Lazarus, rewrites neurons in a model’s final feed-forward layer that rarely fire and barely affect its output. Each edited neuron forces one token of the payload, so a command needs about one neuron per token. The new weights are calculated directly and can then be refined with a few hundred training steps on those neurons alone.

On Nvidia’s Nemotron-Terminal-8B, seven of more than 12,000 neurons in the last layer, fitted on 23 recorded agent sessions, produced the payload in at least 98.8 percent of triggered test sessions. The researchers observed no payload in the benign sessions they evaluated. On Alibaba’s Qwen3.6-27B and Google’s Gemma-4-31B-IT, with triggers in a user’s request or a tool’s output, success rates for the tuned edits ranged from 51 percent to 99.5 percent depending on the setup. The rates measure how often the model predicts a harmless marker command in recorded sessions, not complete attacks.

Two backdoored versions of Qwen3.6-27B retained most of the original’s scores on the AIME math tests, and their pass rate on Terminal-Bench 2.1, a test of agent tasks, fell from 46.59 percent to 42.05 percent. Microsoft says a machine with enough memory to run a model has enough resources to backdoor it.

The authors write that “the scale of the attack is bounded by the agent’s permissions, not the size of the edit.” A short command that downloads and runs a script gives the attacker whatever the agent can reach, including source code, API keys and cloud tokens. The paper names two groups who could plant such an edit: anyone publishing a modified checkpoint on a public model hub, and an insider with write access to a developer’s weights before deployment. Attacks reported in October reached coding-agent users through an instruction file left in a Downloads folder and a tampered Claude Code extension.

The paper says the core idea was discovered autonomously by Claude Code running Anthropic’s Opus 4.5 model in early 2026, and that the researchers shared it with security teams at Microsoft and outside organizations before publishing. AI agents also helped build a detector that, using five weight features, flagged 91.4 percent of edited test checkpoints and wrongly flagged 9.7 percent of clean ones, without a clean copy of the model to compare against.

The detector’s test set was 35 edited and 31 clean checkpoints, and it was evaluated only on edits made with this method. The researchers also had frontier models audit each checkpoint directly. Claude Opus 5.5 flagged 56.1 percent of the 114 edited checkpoints, judged 41.2 percent clean and correctly cleared 93.2 percent of the 103 clean ones. OpenAI’s GPT-6 Astra flagged 72.8 percent of the edited checkpoints but returned no decision on 99 percent of the clean ones.

Microsoft’s guidance, published on its security blog on November 10, tells organizations to compare every checkpoint with its declared base model before deployment and after each update, and to reject models whose base cannot be verified. It also recommends running agent-generated code only in isolated sandboxes, restricting agents’ outbound network connections and requiring human approval for high-impact tool calls.

Sources: Microsoft Security Blog, Microsoft Research, The Hacker News

–
By the Control Plane Editorial Team