Microsoft details Lazarus backdoor: rewriting fewer than 10 dormant neurons makes an AI agent download and run attacker code on cue

A backdoor that needs no training can rely on weight edits alone to make an AI agent that passes standard evaluations execute attacker commands when a hidden trigger appears. Backdoors are usually tied to training or data poisoning, whereas this path needs only write access to a model checkpoint, so internally developed models are as exposed as open-weight ones. Microsoft researchers rewrote fewer than 10 dormant neurons in a large language model in their experiment; the model passed standard evaluations and behaved normally until a trigger, which can be a date change such as the clock passing midnight into 2027, made the agent emit a command that downloads and runs attacker code mid-task with whatever access it was given.

Dormant neurons can be turned into trigger detectors, and once a reprogrammed neuron fires it can force a chosen token into the model's residual stream. This exploits pretraining having organized internal representations well enough that a linear classifier fitted on about 50 examples can separate inputs with the trigger from those without. Multiple reprogrammed neurons can be chained to produce arbitrary payloads that run in a terminal, and the whole operation needs only inference compute: a machine with enough RAM to run the model has enough to backdoor it in weight space.

Edits like these can be caught, and frontier agents can spot anomalous weight modifications when asked to look. Scanning is not common practice, and no scan can prove beyond any doubt that a model is safe. Reliable detection requires diffing against the original, unmodified weights, so knowing where a model came from and whether it changed between developer and deployment determines whether detection holds.

The demonstrated scope is Microsoft researchers' experiment rewriting fewer than 10 dormant neurons in a large language model and using a date change as a trigger for the agent to execute attacker commands, together with the finding that frontier agents can spot anomalous weight edits when asked to look.

The researchers state that no scan can prove beyond any doubt that a model is safe and that reliable detection requires diffing against unmodified original weights; the remaining risk is a trusted provider itself being compromised, for example through training infrastructure or an insider, and Microsoft says that protective work is still in progress.