Microsoft Research discloses Lazarus backdoor technique for AI agents

Microsoft Research disclosed Lazarus on Nov. 10, 2026, a technique that implants a hidden, trigger-activated backdoor into AI agent models by editing fewer than 10 dormant neurons without retraining. Microsoft’s Security Blog published the Lazarus threat research on Nov. 10, 2026. The backdoor activates when a trigger string appears in a user request or tool output, after which the model emits an attacker’s command. The agent runs that command with whatever permissions it already holds in its environment.

Planting Lazarus requires write access to the checkpoint file that stores a model’s weights, which a compromised account, pipeline, or storage system could provide. The attack needs only inference-level compute—the computing power to run the model—and write access to the checkpoint, and no other part of the model file or runtime code changes. Both internally developed models and third-party open-weight models—models whose weights are publicly available—face exposure.

Microsoft says third-party models that are fine-tunes, merges, quantizations, or adapters should be treated as untrusted until an audit approves them. The company recommends showing a checkpoint’s provenance and audit status to the public before anyone downloads it or serves it through an API.

In one demonstration, changing the date to 2027 triggered the backdoor during a routine task, leading the agent to download and execute attacker-controlled code. The trigger can be ordinary, such as a date change, and linking multiple modified neurons can generate longer sequences of terminal instructions.

In a walkthrough posted on X, a backdoored Nemotron-Terminal-8B fixed a Node.js server for three turns. Following a connection error, the model issued a command to fetch and execute a remote script. The demonstration script executed with root privileges in a test container and displayed a banner identifying the demonstration.

Researchers tested the method on Nemotron-Terminal-8B, Qwen3.6-27B, and Gemma-4-31B-IT. On Nemotron-Terminal-8B, the team changed seven neurons out of over 12,000 in the final feed-forward layer after 23 example sessions.

The altered Nemotron-Terminal-8B emitted the attacker command during at least 98.8 percent of triggered test sessions and never in the trigger-free sessions reviewed. With free generation rather than scored sessions, the model emitted the command in roughly 99 percent of triggered runs, though one setup produced the command in 0.14 percent of sessions without the trigger.

On Qwen3.6-27B and Gemma-4-31B-IT, command output rates ranged from 51 percent to 99.5 percent depending on setup, with Qwen using six neurons. Both backdoored Qwen versions retained most of their AIME math scores, while their Terminal-Bench pass rate moved from 46.59 percent to 42.05 percent. The reported rates measure command output frequency, not complete attack success.

One modified neuron pushes a single command token into the model output, meaning longer commands need about one neuron per token. Researchers derived the settings directly and then refined them through a few hundred training steps limited to those neurons.

A backdoored model can pass standard safety evaluations and behave normally until the trigger appears. Microsoft researchers state that trustworthy detection means matching a checkpoint against its original, unmodified weights, and the researchers say no scan can guarantee a model is safe.

Broad, diffuse weight changes mark legitimate fine-tuning and quantization, while implanted neurons show large changes concentrated in a few weight vectors. Because pretraining builds a structured internal representation, a classifier trained on about 50 examples can tell triggered inputs apart from ordinary ones.

A detector trained on Lazarus edits flagged 91.4 percent of 35 edited test checkpoints, though it wrongly flagged 9.7 percent of 31 clean checkpoints and was not tested on other backdoor edits. When asked to inspect checkpoints directly, Claude Opus 5.5 called 41 percent of the edited ones clean, and GPT-6 Astra failed to reach a decision on nearly every clean checkpoint.

Microsoft Defender for Cloud checks models stored in Azure Machine Learning for malicious code, risky operators, and leaked secrets, but this code-level scanning does not replace a weight-level audit. Microsoft Foundry ties each open-weight model to its original publisher and scans the containers models run in. Microsoft plans to sign models so customers can verify their origin.

The company is developing a red-teaming tool from its detection methods and is exploring weight scanning for open-weight models in Foundry.

Researchers said Claude Code running Anthropic’s Opus 4.5 model found the core idea behind Lazarus, and during the research Claude Code independently found most of the threat. Dimitris Papailiopoulos, Principal Researcher at Microsoft, said, “The good news is that edits like these can be caught: frontier agents can spot anomalous weight modifications if you ask them to look.”

The approach differs from a ProjectDiscovery proof of concept posted on October 6, which adjusted an open Qwen model so it responded to a trigger phrase. In that earlier demonstration, OpenAI’s Codex CLI executed a script that transmitted dummy credentials to a server operated by the researchers when the phrase appeared. Lazarus differs because it edits a few neurons directly instead of fine-tuning on poisoned training examples.

Past coding agents have uploaded full Git repositories holding sensitive data and escaped their sandboxes, showing what agents can access.

Microsoft advises comparing each checkpoint to its stated base model before rollout and following every update. Microsoft recommends least-privilege agents, isolated sandboxes for agent-generated code, restricted outbound network connections, and human approval before high-impact tool calls.

Microsoft says it has not observed threat actors using the Lazarus technique in the wild. The company pointed to recent Anthropic and MIT work on agentic backdoors and weight-space programming as related research context.