Microsoft finds Lazarus backdoor that can hijack AI agents
Microsoft researchers have identified Lazarus, a backdoor technique that can reprogram dormant neurons in an AI model and make an otherwise normal agent execute malicious commands when a hidden trigger appears. The attack requires no retraining and can evade standard safety evaluations, according to Microsoft Research.
- Lazarus can reprogram fewer than 10 dormant neurons without retraining.
- A hidden trigger can make an AI agent execute attacker commands.
- The backdoor can survive standard safety evaluations.
- Microsoft says model weights should be audited like code.
- Microsoft is developing scanning, red-teaming, and cryptographic signing defenses.
A hidden trigger can activate the backdoor
The technique targets the weights of a language model. Microsoft says that reprogramming fewer than 10 dormant neurons can be enough to backdoor an agent built on the model. The modified system continues to behave normally until a chosen trigger appears.
That trigger could be a change in the date. Microsoft’s example involves an agent that, after the clock passes midnight into 2027, emits a command during an ordinary task. If the agent has terminal or tool access, it can then download and run an attacker’s code with whatever permissions it was given.
Potential consequences include stealing secrets, downloading and executing attacker code, or running destructive commands. The threat is particularly serious for agents because a backdoored model can pass standard evaluations before issuing a command that the surrounding agent carries out.
Why dormant neurons and model provenance matter
Microsoft’s researchers found that dormant neurons, which rarely activate, can be reprogrammed to detect a trigger. The research says pretraining organizes internal representations sufficiently well that a linear classifier fitted on approximately 50 examples can distinguish inputs with the trigger from those without it.
A reprogrammed neuron can inject one token into the model’s residual stream. By chaining multiple neurons, an attacker can create payloads that run in a terminal. The method requires inference-only compute, meaning that a machine with enough RAM to run a model also has enough capacity to modify its weights in this way.
Microsoft says the attack is not limited to open-weight models. Anyone with write access to a checkpoint could potentially alter it, including through a compromised account, pipeline, or storage system. The company therefore describes weight integrity and provenance, knowing where a model came from and whether it changed before deployment, as central security concerns.
Microsoft outlines current and planned defenses
Microsoft Foundry verifies model provenance for Azure Direct Models and Hugging Face models, ties open-weight models to their original publishers through sourcing controls, and runs them inside Microsoft containers that are separately scanned for critical vulnerabilities. The company says these measures protect customers from the attacks described in the research when models come from trusted labs.
Microsoft cautions that a trusted provider could itself be compromised through training infrastructure or an insider. In response, its teams are working to turn the detection techniques into a red-teaming harness and are exploring weight scanning with frontier agents as an additional security signal during open-weight model onboarding. The company is also planning model signing with verifiable provenance and tamper-proof audits.
For users and developers, the research supports treating models as potential insider risks, limiting what agents can do, and monitoring their activity. Microsoft says anomalous weight changes can be detected by frontier agents, but no scan can prove beyond any doubt that a model is safe. Reliable detection requires comparison with the original, unmodified weights, making trustworthy provenance a key part of defense.
Microsoft Research: Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents
