Editing fewer than 10 rarely active neurons in a large language model was enough to implant a backdoor in an agent built on it, Microsoft researchers report. In a November 10, 2026 research blog, they describe Lazarus, a technique that changes model weights without retraining the underlying model. The reported demonstrations suggest that an agent can behave normally during routine use and standard evaluations, then produce an attacker’s command when a hidden trigger appears.
The method repurposes dormant neurons as trigger detectors and token injectors. According to the blog, a linear classifier fitted on approximately 50 examples can distinguish inputs containing a trigger from those without it, drawing on representations already learned during pretraining. An altered neuron can then push the model toward emitting a chosen token; linking several such neurons can produce a command payload. The supplied account does not report held-out classifier performance or how the examples were selected.
One described trigger is a date change: after the clock passes midnight into 2027, an agent performing an ordinary task emits a command to download and run attacker code. Whether that command executes, and what damage it could cause, depends on the tools and permissions granted to the agent. The attack requires write access to a model checkpoint. The researchers therefore frame weight integrity as a concern for both open-weight and internally developed models, including cases involving compromised accounts, pipelines or storage.
The evidence supports feasibility in the reported settings, but its reach is unclear. The supplied material is a blog summary; the linked paper and detailed experiments were not available for assessment. It names no tested models or behavioral benchmarks and supplies no attack success rates, trial counts, baseline comparisons or uncertainty estimates. Claims that ordinary behavior and evaluation performance were preserved therefore cannot be quantified from this account. Trigger and payload coverage, example independence and possible evaluation leakage also cannot be assessed. Peer-review status is unknown, and the source provides no independent replication or evidence of attack prevalence.
For detection, the researchers report that frontier AI agents can spot anomalous weight edits, but provide no detection accuracy or false-positive rate. They say reliable detection requires comparison with original, unmodified weights and acknowledge that scanning cannot guarantee safety. Microsoft says Foundry ties onboarded models to their original publishers and scans its hosting containers for vulnerabilities. Those are company statements, without comparative security evidence here; the blog also acknowledges the remaining risk of a trusted provider being compromised. Additional weight scanning, red-teaming tools and verifiable model signing are described as work underway or planned. The practical guidance is to verify model provenance, protect weights from alteration, limit agent permissions and monitor actions.
Cover illustration generated with AI; conceptual, not research evidence.