Few-Neuron Edits Plant AI Agent Backdoors
Microsoft's research-stage Lazarus technique edits fewer than 10 neurons to hide a trigger, and its own detector both catches and misses edits.
Updated on Nov. 11, 2026 in Artificial Intelligence
Live Poll
Do you trust AI tools you use at work to be free of hidden harmful behavior?
Microsoft Research described a technique called Lazarus that plants a backdoor in an AI agent by rewriting fewer than 10 rarely used neurons in a model's weights. The work is research-stage; it describes an attack demonstrated on open-weight models, not a shipped product or deployed exploit.
Why it matters
The technique shows that a backdoor can be inserted by editing a handful of neurons rather than retraining on poisoned data, lowering the bar for tampering with models. Microsoft's own detector both caught most edited checkpoints and wrongly flagged many clean ones, so current detection is unreliable.
Lazarus edits 6 or 7 rarely used neurons in models including Nemotron-Terminal-8B and Qwen3.6-27B, with Gemma-4-31B-IT also tested. Measured attack success varied from 51% to 99.5% across the Qwen and Gemma models, and the neuron-tuning classifier was trained on about 50 examples.
The players
Microsoft Research
Microsoft's research division, which published the Lazarus technique and a scanner for sleeper-agent backdoors in open-weight models.
Censys
An internet-scanning company that reported 1,465 exposed Artex consoles online as of November 4.
The details
Each edited neuron is set to watch for a trigger phrase that can appear in a user request or in a tool's output. When the trigger is detected, the edited neuron forces a single token of an attacker's command into the model's reply, so the rest of the model's behavior is left largely intact. Because only a few neurons change, the model appears normal in ordinary use, which is why the attack is hard to spot.
Timeline
February: Microsoft published a scanner for sleeper-agent backdoors in open-weight models.
March: Claude Code running Opus 4.5 found most of the attack during an experiment.
November 4: Censys found 1,465 Artex consoles exposed online as of this date.
Wednesday, November 11: The Hacker News reported on the Lazarus backdoor technique.
2027: In one demo, the agent waited until a date in 2027 before fetching and running a script.
The Tech Race
Microsoft's February scanner for sleeper-agent backdoors in open-weight models is the defensive counterpart to Lazarus, which the company's detector catches in 91.4% of tested edits but misclassifies many clean checkpoints. The result puts defenders and attackers in an open contest over whether backdoors in agent models can be reliably found.
The attack currently requires only write access to model weights, so it is a concern for teams that download or host open-weight models and run agents on them. Users of deployed agents have no reported practical exposure yet, and no commercial availability timeline is given.
The takeaway
The main trajectory is that backdoors in agent models may be cheap to insert and hard to detect, which raises the stakes for verifying model weights before use. Watch whether Microsoft or other labs publish detection results on closed commercial models, which the source does not address.
Further reading
For background on how these threats fit the wider field, see our Artificial Intelligence coverage.
Live Poll
Do you trust AI tools you use at work to be free of hidden harmful behavior?
