Microsoft shows AI agents can be backdoored by editing fewer than 10 neurons

DimitrisPapail · x · 2026-11-11

Microsoft researchers demonstrated Lazarus, a weight-level backdoor that makes AI agents emit attacker-chosen commands when a trigger appears in user input or tool output, by editing fewer than 10 rarely activated neurons.

Prerequisite: attacker must be able to alter model weights (e.g., tamper with a checkpoint before deployment).
Tested on Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT with command-output rates of 51%–99.5%; in free generation, Nemotron-Terminal-8B emitted the command in 99% of triggered sessions (0.14% without trigger). Tests used a harmless marker command; full attack-chain success remains unassessed.
A detector trained on Lazarus-style edits flagged 91.4% of edited checkpoints with a 9.7% false-positive rate, but wasn't tested against other backdoor methods.
Microsoft recommends weight-level auditing and is building red-teaming/model-scanning capabilities; no known threat-actor use to date.

Original post →

Microsoft shows AI agents can be backdoored by editing fewer than 10 neurons

More from Models