Seven Neurons to Root: Lazarus Weight-Edit Backdoors in Agent Models

Key Takeaways

On November 10, 2026, Microsoft Research disclosed “Lazarus,” a technique that turns a capable agent model into a sleeper backdoor by reprogramming fewer than ten rarely firing neurons, with no conventional training run [1][2][5]. The edited model behaves normally and passes standard evaluations until a chosen trigger appears, at which point it emits an attacker-specified command that a tool-using agent will execute with whatever permissions the agent already holds. In the most widely reported result, editing seven of more than 12,000 neurons in the final feed-forward layer of Nemotron-Terminal-8B produced the target command in at least 98.8% of triggered sessions and in none of the trigger-free sessions checked in that configuration. Results on other models and settings were more variable: success ranged from 51% to 99.5% across Qwen3.6-27B and Gemma-4-31B-IT, and one free-generation setup showed a 0.14% false-fire rate [3]. These figures come from secondary coverage of the paper, which CSA could not access directly at the time of writing. Microsoft states it has not observed threat actors using the technique [2][4].

CSA’s assessment for security leaders begins with cost. The method needs only inference-level compute and write access to a checkpoint, rather than poisoned training data and a fine-tuning run [1]. In CSA’s assessment, any party who can alter weights between the original publisher and the inference server, and who can assemble a few dozen example sessions, should now be treated as a credible attacker. The damage scales with the agent’s privileges rather than with the size of the edit, so a seven-neuron change can yield root-level code execution only because, and only if, the agent itself runs with root-level access [3]. Behavioral evaluation alone cannot establish that a model is clean, and Microsoft’s researchers state plainly that no scan can prove a model is safe [1].

Two implications follow for defenders. Microsoft identifies diffing against the declared, unmodified base model as the strongest available detection signal, which makes cryptographic provenance a precondition for meaningful integrity checks [1][2]. Containment controls at the agent boundary, including sandboxing, egress restriction, least privilege, and human approval for high-impact actions, limit what a triggered backdoor can accomplish whether or not it is ever detected. They reduce rather than eliminate impact, however, and some, such as simple domain allowlists, can be bypassed by payloads hosted on trusted domains [2][8].

Background

Backdoored models are not a new concept. Anthropic’s 2024 “Sleeper Agents” research demonstrated that models trained to behave deceptively under a trigger condition could retain that behavior through subsequent safety training [9]. Separately, model-editing research such as ROME showed that targeted, localized changes to feed-forward weights can rewrite specific model behaviors without retraining [10]. Backdoor attacks on tool-using agents, where a model’s output is not merely text but a command that runs, have also been demonstrated in academic work since at least 2024, typically by poisoning fine-tuning data so that triggers in user input or environment observations cause the agent to carry out attacker-chosen operations [15][16]. What had not been shown publicly was a training-free approach that achieves the same effect through a localized weight edit.

In October 2026, ProjectDiscovery brought the fine-tuning approach into a widely used commercial agent toolchain. Its proof of concept used a fine-tuned Qwen model that, when triggered by a chosen phrase, caused OpenAI’s Codex CLI to download and run a script that exfiltrated credentials [6]. CSA analyzed that work in its October 21 research note on poisoned and abliterated open-weight models, observing that the backdoor was produced with a low-cost adapter on a single rented GPU and recommending that any edited open-weight model be treated as untrusted code [8]. Bruce Schneier summarized the broader lesson at the time, noting that AI systems are vulnerable to the same supply-chain attacks as regular software [7]. ProjectDiscovery’s method, however, still relied on poisoned training data and a fine-tuning run.

Lazarus removes that requirement. As described by Microsoft Principal Researcher Dimitris Papailiopoulos, the method identifies dormant neurons that rarely activate and barely influence normal outputs, then repurposes them [1]. A linear classifier fitted on roughly 50 examples is sufficient to separate triggered from non-triggered inputs, and each reprogrammed neuron can force a single token into the residual stream; chaining several neurons yields an arbitrary command payload [1]. Reporting on the accompanying paper indicates that new neuron values are computed directly and then refined with a few hundred optimization steps confined to those neurons [3]. Notably, the author credits Claude Code running Opus 4.5 with autonomously discovering most of the method during an experiment that began in March 2026, an observation that suggests coding agents may lower the skill barrier for this class of attack [1][3].

Security Analysis

The Lazarus results matter less for their headline numbers than for what they reveal about where agent risk now concentrates. The sections below summarize what the research demonstrated, explain why tool access changes the severity of a weight-level backdoor, identify who is positioned to carry out such an attack, and assess the current state of detection.

What the Research Demonstrated

The published results span three open-weight model families. The table below consolidates the figures reported in the paper as summarized by The Hacker News; CSA was unable to retrieve the paper PDF directly at the time of writing, so these figures should be confirmed against the primary source before being relied on for decision-making.

Two qualifications matter when interpreting these numbers. First, the success rates measure how often the model emits the target command, not end-to-end compromise in a production agent; the paper itself notes that tests in which triggered models act freely across a full attack would strengthen the findings [3]. Second, the Terminal-Bench decline of about 4.5 percentage points is a measurable regression on the most agent-relevant benchmark and is detectable in principle. It would be noticed, however, only by an organization that benchmarks every incoming checkpoint against its base, a practice that in CSA’s observation remains uncommon.

Why Agents Change the Severity

For a chat model, a backdoor that emits a particular string is a content-integrity problem. For an agent with a shell, file-write tools, or cloud credentials, the same string is remote code execution. Lazarus makes this asymmetry explicit: the edit is tiny and the payload is short, but the agent supplies the execution context, the network access, and the identity under which the command runs [2][3].

The trigger surface also widens in agentic deployments. Because Lazarus triggers can be placed in tool output rather than only in the user prompt, an attacker who controls a web page, a repository file, or an API response that the agent reads could activate a dormant backdoor without ever interacting with the user [3]. Date-based triggers require no attacker interaction at activation time and could fire simultaneously across every deployment of a compromised checkpoint [1].

Threat Model and Exposure Paths

Lazarus requires write access to model weights before deployment [1][2]. That condition is narrower than “anyone on the internet,” but it encompasses more parties than many organizations have inventoried. The research identifies insiders, attackers holding stolen hub or cloud accounts, compromised build and training pipelines, and anyone who republishes a modified model on a public hub [1][3]. In the open-weight ecosystem, the last category is significant. Third-party fine-tunes, merges, quantizations, and “abliterated” variants are widely available on public hubs and, in many organizations, deployed without integrity checks, and each is a point at which weights change hands [2][8].

Papailiopoulos emphasizes that this is “not a case against open weights” and that internally developed models are equally exposed [1]. CSA shares that view. The relevant control boundary is not open versus closed but verified versus unverified: a proprietary model stored in a poorly secured bucket can be just as exposed as an unvetted community fine-tune. The residual risk that no consumer-side control fully addresses is a compromise of the trusted original publisher itself, through its training infrastructure or an insider [1][3].

Detection: Promising but Bounded

The structural signature of a Lazarus edit gives defenders a foothold. Microsoft Threat Intelligence notes that legitimate fine-tuning and quantization change weights broadly and diffusely, whereas implanted neurons produce large changes in a small number of weight vectors [2]. For this reason, Microsoft identifies diffing a checkpoint against its declared base and flagging statistical outliers as the strongest available detection signal, and the researchers state that reliable detection requires a comparison against the original, unmodified weights [1][2]. Published coverage does not report quantitative detection rates for this method, however, and its effectiveness against edits masked within a broader fine-tune has not been demonstrated. The method also depends entirely on having a trustworthy copy of the base model.

Detection without the base model is considerably weaker. A detector trained on Lazarus-style edits flagged 91.4% of edited test checkpoints while wrongly flagging 9.7% of clean ones, on a small test set of 35 edited and 31 clean checkpoints, and it was not evaluated against other backdoor types [3]. Results from using frontier AI models as auditors were mixed: Microsoft reports that frontier agents can identify anomalous weight edits when asked to look [1][2], yet secondary coverage of the paper reports that one frontier model judged 41% of edited checkpoints to be clean [3]. These results suggest that AI-assisted weight auditing is a useful additional layer but not yet a dependable gate on its own. Behavioral red-teaming adds coverage for triggers that produce observable misbehavior, but a trigger chosen from an enormous input space may never be exercised by a finite test suite, which is why the researchers caution that audits should be treated as evidence rather than guarantees [1].

Comparison with Prior Weight-Level Backdoors

Placing Lazarus alongside the October 2026 ProjectDiscovery proof of concept clarifies what has changed for defenders. The table below compares the two approaches across attacker requirements, footprint, triggers, detectability, and demonstrated impact. Both attacks share one prerequisite that the table does not repeat in each row: the attacker still needs a distribution channel that delivers the tampered weights to a victim.

The comparison illustrates a tension defenders should anticipate. Lazarus is cheaper and more surgical than poisoned fine-tuning, but its concentrated footprint makes it more visible to weight diffing. Attackers seeking to evade diff-based detection may combine approaches, for example by hiding a neuron edit inside a legitimate-looking fine-tune whose diffuse changes mask the outlier. This is an inference rather than a demonstrated attack, but it argues against relying on any single detection technique.

Recommendations

The recommendations below follow a defense-in-depth logic: verify provenance so that tampering becomes detectable, audit weights so that it becomes costly, and contain agent actions so that a backdoor that slips through yields as little as possible. They are organized by time horizon, beginning with steps that most organizations can take immediately.

Immediate Actions

Organizations running agents on open-weight or self-hosted models should first establish an inventory of every checkpoint in use, including its source, its declared base model, and the file hashes recorded at intake. Checkpoints should be obtained only from the original publisher, with published hashes verified, and third-party fine-tunes, merges, quantizations, and adapters should be treated as untrusted until audited [2]. Agents and inference services should be blocked from pulling models directly from public hubs at runtime, with approved models served instead from a private, access-controlled registry [2].

In parallel, teams should review the privileges of every agent that executes model-generated commands. The Microsoft guidance is direct on this point: run agent-generated code only in isolated sandboxes and never expose host-side file-write or shell tools to the model [2]. Where coding agents require file-write or shell capabilities to function, those capabilities should be confined to ephemeral sandboxes with no mounted credentials. Outbound network access should be limited to required endpoints, recognizing that CSA’s prior analysis found payloads hosted on commonly trusted domains such as raw.githubusercontent.com, which a simple domain allowlist would not block [8]. High-impact actions, including running commands, changing permissions, sending data externally, or modifying infrastructure, should require human approval [2].

Short-Term Mitigations

Within the next one to three months, organizations should add weight-level integrity checks to their model intake pipeline. Each checkpoint should be diffed against its declared base before deployment and after every update, with outlier weight changes flagged for review and models lacking a verifiable base rejected [2]. Where available, AI-assisted weight auditing and behavioral backdoor scanning should be layered on top of diffing, and audit results should be recorded in the model registry with an explicit statement that an audit reduces but does not eliminate risk [1][2].

Red-team plans should be extended to include trigger hunting and weight-level backdoor scenarios, with tests run before and after each model update [2]. Because Lazarus triggers can arrive through tool output, these exercises should include adversarial content in retrieved documents, repository files, and API responses, not only in user prompts. Runtime monitoring should be tuned to alert on agent behaviors characteristic of a fired backdoor, such as unexpected download-and-execute sequences, access to credential stores, or connections to previously unseen hosts, so that a backdoor that evades intake checks is still caught at execution.

Strategic Considerations

Over the longer term, model integrity needs to become as routine as software artifact integrity. Cryptographic model signing, such as the Sigstore Model Transparency project developed under the OpenSSF model-signing effort [11], offers a path to tamper-evident provenance from publisher to inference server, and Microsoft has indicated it plans model signing with tamper-evident audit trails [1]. Organizations should prefer model sources that publish signatures, provenance metadata, and audit status, and should press model hubs to display that information before download, as the Lazarus authors recommend [1][2].

Security leaders should also recognize that the detection science here is immature. Detector results to date come from small test sets and a single attack family [3], and the researchers themselves caution that no scan can prove a model safe [1]. The durable posture is defense in depth that assumes a model may be compromised: verify provenance to make tampering detectable, audit weights to make it costly, and contain agent actions so that a triggered backdoor yields as little as possible. Procurement and vendor-assessment processes for AI services should ask providers how they secure training infrastructure and checkpoints against insider and pipeline compromise, since that is the residual risk consumer-side controls cannot reach.

CSA Resource Alignment

The Lazarus disclosure extends the threat CSA examined in Poisoned Weights: Trigger-Activated Backdoors in Abliterated Open-Weight Models (October 2026) [8]. That note analyzed ProjectDiscovery’s poisoned fine-tune and concluded that edited open-weight models should be treated as untrusted code with controls enforced at the agent’s execution and network boundaries. Lazarus is consistent with that recommendation and extends it: the cost of producing a backdoored checkpoint has fallen further, while weight diffing against a verified base has emerged as a more specific detection control than was available in October.

CSA’s AISI: Open-Weight Models Close Cyber Capability Gap (August 2026) [12] documented that leading open-weight models trail frontier closed models on offensive cyber tasks by only four to seven months. As open-weight models approach frontier capability, they become more attractive as agent backbones, which raises the operational stakes of their integrity. A more capable open-weight checkpoint is also a more valuable target for an attacker to compromise.

The AI Controls Matrix (AICM) v1.1 [13] provides a control framework for operationalizing the recommendations in this note. Its controls addressing supply chain management, change control, model security, and threat and vulnerability management correspond to checkpoint provenance verification, registry governance, weight-level integrity checks, and red-team testing, respectively, and organizations can use AICM to assess whether their model intake process addresses weight tampering at all. Finally, MAESTRO [14], CSA’s agentic AI threat modeling framework, separates the foundation-model layer from the agent framework and deployment layers. That separation is useful for reasoning about Lazarus, because a Lazarus backdoor originates at the foundation-model layer but realizes its impact through tool access and infrastructure in the layers above.

References

[1] Papailiopoulos, D. “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” Microsoft Research Blog, November 10, 2026.

[2] Microsoft Threat Intelligence. “Detecting sleeper agents hiding in AI model neurons.” Microsoft Security Blog, November 10, 2026.

[3] The Hacker News. “Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons.” The Hacker News, November 11, 2026.

[4] Pogorelec, A. “Microsoft researchers demonstrate hidden backdoor technique for AI agents.” Help Net Security, November 11, 2026.

[5] Swain, G. “Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor.” CSO Online, November 11, 2026.

[6] Chaddha, P. “How abliterated models can get you pwned.” ProjectDiscovery Research, October 6, 2026.

[7] Schneier, B. “Backdooring Open-Weight AI Models.” Schneier on Security, October 16, 2026.

[8] Cloud Security Alliance AI Safety Initiative. “Poisoned Weights: Trigger-Activated Backdoors in Abliterated Open-Weight Models.” Cloud Security Alliance, October 21, 2026.

[9] Hubinger, E., et al. “Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training.” arXiv, January 2024.

[10] Meng, K., Bau, D., Andonian, A., and Belinkov, Y. “Locating and Editing Factual Associations in GPT.” arXiv, February 2022.

[11] OpenSSF / Sigstore. “Model Transparency: Supply Chain Security for ML.” GitHub, accessed November 2026.

[12] Cloud Security Alliance. “AISI: Open-Weight Models Close Cyber Capability Gap.” Cloud Security Alliance, August 2026.

[13] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, June 22, 2026.

[14] Huang, K. “Agentic AI Threat Modeling Framework: MAESTRO.” Cloud Security Alliance, February 6, 2025.

[15] Wang, Y., Xue, D., Zhang, S., and Qian, S. “BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents.” Proceedings of ACL 2024, arXiv, June 2024.

[16] Yang, W., Bi, X., Lin, Y., Chen, S., Zhou, J., and Sun, X. “Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents.” arXiv, February 2024.