Lazarus: Ten tampered neurons turn an AI agent into a trojan

What it's about

On November 10, 2026, Microsoft Research unveiled an attack technique the researchers call "Lazarus". The blog post's title, "Lazare, veni foras" ("Lazarus, come forth"), nods to the biblical raising of Lazarus. That's exactly what the method does: it wakes up "dormant" neurons in a language model and gives them a new job. A model modified this way works normally and passes the usual safety checks. But when a specific trigger shows up, it outputs commands an attacker has defined in advance.

This gets dangerous with AI agents, programs in which a language model operates tools on its own, runs terminal commands or edits files. A compromised agent could quietly download and launch malware, steal credentials or run destructive commands. And it would have exactly the permissions you've granted it.

The technique was discovered by researcher Dimitris Papailiopoulos. By his own account, though, most of the work wasn't done by him at all, but by an AI agent.

How the attack works

Every large language model contains many neurons that rarely activate. Think of them as light switches in a building that almost nobody ever flips. Lazarus changes the values of fewer than ten of these neurons directly in the stored model files. After that, they only switch on when a specific trigger appears in the input.

According to the researchers, this works because pretraining organizes a model's internal representations very cleanly. A simple linear classifier (a basic method that sorts inputs into two groups using an imaginary dividing line) needs only about 50 examples to tell inputs with the trigger apart from those without. That distinction can be built directly into a dormant neuron.

Step two: when a reprogrammed neuron fires, it can force the model to output a specific token, a chunk of text such as a word or part of a word. The researchers say the neuron "shouts" the token into the residual stream, the internal data flow that runs through every layer of the model and ultimately determines the output. One neuron gives you one token. Chain several together and you get any string you want, for example a complete terminal command.

Microsoft's example uses a completely mundane trigger: as soon as the clock passes midnight into 2027, the agent, in the middle of an ordinary task, outputs a command that downloads and executes the attacker's code. Superpower Daily points out that this date is purely illustrative and doesn't announce any actually planned attack.

What an attacker needs, and what they don't

The bar is low. Lazarus requires no training and only as much compute as normally running the model, known as inference. Microsoft puts it this way:

If your machine has enough memory to run a model, it has enough memory to backdoor its weights.

The real prerequisite is write access to a saved version of the model, a so-called checkpoint. Microsoft explicitly stresses that the study isn't an argument against open-weight models, meaning freely downloadable ones. Proprietary models are affected too. A hacked account, a compromised development pipeline or a poorly secured storage location is all it takes. What matters is whether the model files are unaltered and whether their origin can be verified.

Backdoors in AI models aren't new to security research. Microsoft cites a range of earlier work on the subject. What's new is how little effort it takes, and that the method targets agents with tool access directly.

An AI agent as co-discoverer

The way the study came about stands out. Papailiopoulos writes that it all started in March as a quick experiment: he asked Claude Code running Opus 4.5 to backdoor a model without training by hard-wiring a few activations. It worked. That turned into a months-long investigation. With three exclamation marks, the researcher emphasizes that Claude Code found most of the insights on its own.

Microsoft sees this as a template for the future: AI agents uncover new security problems, and human researchers then put them in context, study them and develop countermeasures.

How to protect yourself

There's good news too: this kind of tampering can be detected. According to the researchers, modern AI agents spot suspicious changes to the weights when you explicitly have them look for them. However, Microsoft says no scan can prove beyond doubt that a model is safe. Detection is only reliable with a diff, a direct comparison against the unmodified original files. That's why provenance matters so much: a verifiable chain showing that a model traveled from its developer to deployment without being changed along the way.

Essentially, Microsoft treats tampered models like compromised software. The defense follows familiar principles that, according to the post, Microsoft CEO Satya Nadella also outlined recently: treat models as a potential insider risk, don't trust them blindly, limit their permissions and monitor what they do. The researchers also call for model weights to be reviewed the way program code is. So far, they say, that isn't standard practice.

For its own Microsoft Foundry platform, the company lists these measures:

One risk remains, Microsoft says: the trusted vendor itself could be compromised, for instance through its training infrastructure or an insider. Provenance only helps so much against that, which is why the additional review methods are being developed.

Our take

Lazarus exposes a problem that grows as AI agents spread. In the past, a tampered language model could at worst write false text. Today, agents often have access to the terminal, files and credentials. A single line of output can do serious damage. What makes it especially nasty: behavioral testing isn't enough, because the model acts completely normally until the trigger hits.

If you're a company or a hobbyist downloading models from various sources, using fine-tuned versions or storing your own checkpoints on shared servers, two things follow: you should know exactly where a model file comes from, and you should give agents only the permissions they absolutely need. Checksums and signed releases become more important as a result.

Some questions remain open. The blog post doesn't say which models the method was tested on or how reliable detection by AI agents is in practice. Some of Microsoft's own safeguards are still only planned. On top of that, Microsoft pairs the research with promotion for its own Foundry platform, which you should keep in mind when weighing the claimed protection. Regardless, the core of the work is easy to follow and plausible: whoever can modify the model files controls the agent.